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Chapter i: Introduction 



l.l Purpose 



This document is a manual for system administrators on the 
Multics system. It does not describe the internal structure of 
the system-administration data bases or the programs which 
manioulate them: consult the MPM SPS and the MSPM for these 
details. This manual is intended to be a useful quide for the man 
who has to set up and run a Multics system. 

1.2 Resource Control 

The ovarall Job of the Multics system-administration proqrams is 
to control the use of system resources and to keen records about 
how they were used. They must also support rationing of 
resources. orovide system security services* and produce usage 
reoorts and bills as required. 

Multics resources are used by logqed-ln ysgrs., each of whom has 
(at least one) 2L2c,2SS under his control. The user is 
Identified, when he attempts to log in, by his person TO and his 
project ID. A process is then created for him, and his resource 
usage is metered by various hard-core modules. These meter 
readings are collected and keot in the Multics storage system, 
and are made available to the resource-monitoring and billing 
orograms. 

In order to log a user in, some process must execute a program 
which reads the supplied lo.gin request line and oassword, and 
checks them agains the list of valid users, also keot in the 
Multics storage system. To provide maximum protection for this 
segment, the orocess in which the login oroqram executes is a 
fictitious user of the system, called the "answering service." 
(This process is also called the "Initializer process," because 
it is the orocess created during the system initialization 
sequence, and the "system control process.") Almost all 
resource-usage metering functions are performed in the 
initializer orocess. The generic term for the thirty or so 
orograms which deal with system resource control is "user 
control" or "system control." 

The administrative and resource-control functions of Multics 
comorise a sizable subsystem, which, like the rest of the 
operating system, is designed to continue to grow, and to allow 
many ootional facilities which a oarticular installation may 
decide to byoass. 
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The system administration facilities are organized Into several 
functional areas, with well-defined interfaces. There are six 
major areas* each of which contains several subsystems. 

1. Hardcore resource multiplexing and metering. The central 
oa"~t of the supervisor, esDeclally the Traffic Control, Page 
Control, and fault and Interrupt service modules, has 
primary responsibility for providing users with access to 
the system's resources. These modules also keep extremely 
fine-grained meters which record the usage of each process. 

2. Hardcore interfaces to the user. The Multlcs Storage System 
provides Directory Control services which organize data for 
a user and control access to data, and keen fine-grained 
meters and quotas on storage usage. The Interprocess 
Communication facilities allow for synchronization of and 
cooDeration between processes. 

3. Otner suoervisor services. Other tape and data-management 
services are also provided by the Multlcs suoervisor to 
allow users access to system resources and to control the 
manner in which these resources are used. 

k. System control. User Identification and login control, 
basic accounting functions, file backup, control of shared 
devices such as line printers, and operator communication 
are orovided by system control. 

5. System Administration. User registration services and 
billing operations are oerformed by the system 
administrators. This manual is primarily a guide to the 
ooeratlon of programs in the system administration area. 

6. User project administration. Some grouos of users may have 
the ability to manage some of their own resources. This 
manual, and the Multics Project Administrator's Manual, 
describe operations in the user project administration area. 
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1.3 System administrators 

There are three kinds of system administrators: 

1. Unrestricted system administrators. 

2. Restricted system administrators. 

3. Project administrators. 

The system administrators are users of Multics 1iKe any other 
users. They must log in the same way that other users do, and 
when they log in a process is created for them in the same way as 
for other users. They differ from other users of Multics in that 

1. They have access to certain segments which regular users 
do not. It is possible* but not necessary, for them to have 
access to al I segments in the system. 

2. They use special programs to manipulate the accounting 
data bases. In general* these programs do not make 
privileged calls? they are ordinary PL/1 programs which 
manipulate data in ordinary ways. The data for these 
programs* though, are accounting records and control 
segments which normal users have no access to. 

3. The system will grant certain requests for them which it 
will not grant for normal users. Tn particular, the 
initializer process will install system tables for system 
administrators, to change passwords or add new users. 

h. Some privileged calls are available to the system 
administrators. A system administrator is oulte often a 
very experienced system programmer, and so some soeclal 
abilities, such as the privilege of being ah I e to natch the 
system, are available to the system administrators. Almost 
no use of this ability is made in the design of the 
system-administration package. 

The restricted and unrestricted system administrators are users 
on the project "SysAdmin". Since they therefore have access to 
the system-administration segments and programs, they can 
completely control the system's resources. A restricted system 
administrator has a special initial procedure, 

accounts_overseer_ 

which provides him with a special set of commands designed for 
system administration. Although a restricted system 
administrator has access control privileges which would 
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ootentlally enable him to destroy any segment In the system, he 
is traDoed in his soecial command system, and so can only perform 
soecific accounting functions. 

An unrestricted system administrator can use any Multics command. 
(He may also use the soecial command system.) Because the 
unrestricted system administrator can cause damage to the segment 
hierarchy, circumvent access control restrictions, and destroy 
resource accounting, only careful and carefully-trained 
programmers with a good knowledge of Multics should operate as 
unrestricted system administrators. 

D roJect administrators are in charge of a particular prolect. A 
system administrator can function as a project administrator for 
any oroject. Initially, all projects are set up with only the 
system administrators. If a protect needs more control over Its 
usage than the system administrators can provide, they may 
delegate control of the oroject to a project administrator. 
Project administrates, too, can cause damage to segments, but 
only those of their projects. They should therefore be 
responsible individuals who are willing to do the necessary work 
to keeo orojects running smoothly. Project administrators are 
usually normal Multics programmers who have taken on additional 
responsibilities? they are given no special command system, but 
certain commands will work for them which will not work for 
non-admin Istrat or s. 
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l.k Definitions 

A person is a human being or something (such as a daemon) that is 
treated like one by the system. Each registered oerson is 
identified by a strlnq of one to 22 characters* beginning with a 
caoital letter, called a person, TO* which is unique within the 
installation. Usually* the person 10 is the person's last name. 
Each oerson has several attributes which the system remembers* 
including a personal oassword and a default project 10. These 
items* along with information about the user such as full name 
and title, mailing address* and programmer number, are maintained 
by the system administrators. 

The term user is used in two different ways. We often speak of a 
logged-in oerson as a user, and, sometimes, use the term to refer 
to the process which the user Is controlling from his terminal. 
Esoeclally In the context of user control, however, we apoly the 
term US.S.C. to any member of the set of users (in the first sense* 
who c.o.u.ld log In. In other words, we speak of a user as a 
registered identity. 

A o.roJje.c.i is a grouping of users for resource control ourooses. 
Each oroject is identified by a string of from one to nine 
characters, beginning with a caoital letter or a digit, called a 
£r.flJL££± IQ» which is unique within the installation. 

Each user is associated with a project. The user is identified 
for access control purposes by the concatenation of his oerson ID 
an1 his project ID. A nerson may be registered as a user on more 
than one project? we consider him to be two different users in 
this case. 

Since the project 10 makes up the second component of each 
user's ac cess contr ol name.* permission to log in on a project 
confers the ability to reference certain segments. 

The list of persons who may log in on a project is contained in a 
segment within the Multics storage system. This segment is 
accessible only to the system and to the system administrator. 
The segment is known as a project dgf l.OitlPP table (odt) . There 
is one entry in the odt for each user, which contains the user's 
attributes and usage information for the current month. 

Each project has an administrator associated with it. The 
administrator for a project may be the system administrator* or 
the Droject administrator may be some other user of Multics. 
Project administrators will receive monthly usage reports 
describing the activity of users of the project. 

4 DXiilac.1 directo ry is established for each project. This 
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is contained in the directory ">user_dir_dlr". It 

ontains a £lP.m£ directory for each user of the project* 

the project administrator may specify some other 

t. The project directory has a disk gyota* which 

total amount of disk storage which the project may 

he oroject administrator may subdivide this quota among 

s inferior to the project directory, or he may elect to 

or all of the directories inferior to the oroject 

to have a zero quota* and to charge their usage to the 

rectory quota. 



Each oroject is a member of a I oad control group.. which is a 
qrouoini of projects which share a guaranteed access to the 
system. Each load control group has a quota of "primary" load 
units *hich represents a guaranteed number of users from the 
grouo who will be able to log in. Users in excess of the grouo's 
quota will be allowed to log in if the system Is not full* but 
will be subject to o^eemotlon by orlmary users from other groups. 
The oroject administrators for the Drojects of a grouo may 
cooperate to control who from the group may have primary status* 
and for how long. 



The lo^d control grouo feature can be used to satisfy large 
customers of the system* while orotecting the small user's 
abilitv to be able to access the system. This feature of Multics 
is ODtional, though! an installation may simply put all users in 
the same group and byoass the facility entirely. 
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2.1 >syst em_contro I _di r 

The most important directory for the system-administration 
oroarams is the initializer's home directory, 

>system_control_d ir 

This directory, right off the root, contains those segments 
referenced by the Initializer during the processes of 

1. Logging in a user 

2. Logging out a user 

3. Accounting for user usage 

h. Installing new system-administration tables 
5. System startup 

The contents of this directory include the following special 

segments? 

Unes the list of GIOC channels to accept dialups 

and logins from, referenced at system 
start-UD. 

sat the System Administrator's Table, containing 

an entry for each legal oroject plus some 
per-system quantities. This table Is 
referenced at every login, to validate the 
user's project id, 

Insta I I at ion_parms installation-defined constants, including 

shift definitions and orlces 

D nt the Person Name Table, containing the 

identification of all registered persons. 
This table is accessed at most logins, to 
determine the user's password, 

10 accounting the 10 daemon accounting records, one "card" 

Der orlnt or punch operation 

stat_seg on-line system statistics sampled every 

accounting update 

answer_table a table which has an entry for each terminal 

line, with the name and accounting data and 
process Id of the user logged in on It 

whotab the oublic list of logged-ln users 

absentea_user_tab the "answer_tab I e" for absentees 
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absenteeN.ms the absentee user Job queue for queue N 
ont.ht a hash table for the pr>t 

message_of_the_day a message tyoed by the user process during 

the normal process startup 

pro ]_admin_seg a segment publishing the initializer's event 

channel used to signal updates of 
system-control tables by administrators 

log the initializer's log of events of interest. 

Many initializer messages are tyoed to the 
operator and also recorded in this segment. 

admin. ec a special segment giving sequences of 

commands which operators may be allowed to 
execute as macro-operations. 

login_helo a segment which is typed if a user says 

"help" Instead of "login" 

master_group_tabl e a table giving the guaranteed load units for 

each load control group and listing the 
groups' current occuoancy. This table Is 
accessed at each login to determine whether 
the attempted login would overload the 
system. 

In addition* other segments may be kept in >system_cont rol_dlr, 
such as segments necessary for system reloads. 

There are two subdirectories of >system_con tro l_dir which are 
important. The first directory* 

>sys tem_control _dlr>odt 

contains a pdt for each legal project. Whenever a user logs In, 
his odt entry is located in his project's odt, and the user's 
attributes are used to initialize his process. The usage data 
figures in these pdt's are updated while the system is running. 

The second subdirectory, 

>system_control_dir> instal I 

is used when an administrator requests the installation of a new 
cooy of a system table. 
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2.2 >user_dir_dir>SysAdmin 

Another important directory is the system administration's 
project directory, 

>user_dir_dlr>Sys A dm in 

anl the directories and segments inferior to It, 

2.2.1 >user_dir_dir>SysAdmln>admln 



All dat^ segments pertaining to system administration should be 
KeDt in a single directory inferior to >udd>SysAdmln. At MIT, 
this directory is called 

>u1d>SysAdmin>admin 

It contains the following! 

urf the user registration segment* giving names 

and addresses* and person I0*s. This segment 
is used when a person is registered, to 
guarantee that his person 10 is unique at the 
insta I latlon. 

urf.ht a hash table for this segment 

reqfile the requisition segment, containing account 

number, billing address, total charges, and 
requisition number for each usage account* 

projfile the project segment, containing descriptive 

Information about each project, Including 
title, supervisor address, and disk storage 
usage. 

miscfile the miscellaneous charges and credits Journal 

pmf. archive an archive Of all pmf's for projects run by 

the system administrator 

PNT.pnt a copy of the system pnt 

ont.ht a hash table for this segment 

smf.cur the current smf This Is converted to a sat by 

"cv_smf" 
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smf .cur , sat 
disk stat 



a Cody of the current sat 

a segment giving disk quota and usage for all 
directories with Quota 



lnstal lation_parms a backup copy of the same segment in 

>system_contro l_dir 



I ines 

smf .new 

cutrpt 

sumry 
diskreport 



a backuo copy of the same segment in 
>system_control_dir 

the next version of the smf, some commands 
make changes to this segment. AH changes can 
be put into effect by typing "new_smf" 

a report, showing accounts which are cut off, 
prepared daily 

a renort of account status, oreoared daily 

a report, giving project disk usage, prepared 
on request 



delegated_pmf .archive an archive of all pmf's for delegated 

projects, giving the pmf at the time of 
delegation. Changes by project administrator 
are ngt ref lected. 



daemon_backuo.ec 



metered at a 



t o day . u se_t o t a I s 



this segment becomes an "absin" segment at 
the end of the month which lists all daemon 
use 

a copy of the contents of 
>system_control_i>stat_seg, made every day, 
for use in generating system statistical 
reoorts . 

a statistical data base which describes 
month-to-date system resource availability 
and usage. 



yesterday. use_totals the previous day's copy of today. use_tota I s. 

dai ly_raport. control a segment which describes which prolects 

will be summarized under each category in the 
daily and monthly statistical reoorts. 



system, report 
o I domf , arch ive 



the daily statistical report, 

an archive of pmf's for deleted projects 
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PNT.ontn orevious cooies of the on t , In case of crash 

smf.oldn orevious cooies of the sm f , in case of crash 

dal I y_) og_ti extracts from the system loo, oreoared for 

printing each day 

log_sel ict_f i le a segment which controls the Drogram 

"dai I y_log_orocess" in its selection of 
messages from the log for daily printing 

suffix_list a segment which controls the orogram 

"d tsk_usage_stat" in its selection of segment 
names to summarl7e 

termseg a segment which lists terminals ^by terminal 

id code, used by "console.reoort" 

termuse? a segment which lists the users^of each 

terminal created by "console.reoort" 

Other data segments kept in this directory Include backup copies 

of billing data for orevious months and other temporary segments. 

It is in this directory that the monthly bills and statistical 
reoorts are written. 

"Filled" and processed TO accounting segments and log files for 

the current month are keot in a special subdirectory, 

>udd>SysAdmin>admin> history 

until the end of the month. 

Every night, the system_contro l_dir cooies of the sat and the 
odfs are copied into the directory 

>udd>SysAdmin>admin>saf e_pdts 

to orov/ide backuD billing data. The cooies are also used at the 
end of a billing period, to reset the usage charges In the system 
odfs. 

Cooies of the usage totals, "orojfile", and "reqflle" for 
orevious months are keot In another special subdirectory, 

>udd>SvsAdmin>admin>HF 

for at least a month, so that the billing can be re-run if 
necessary. These segments should be dumped to tape and deleted 
after a reasonable period. 
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2.2.2 >user_dir_dlr>SysAdmin>| lb 

Those segments which are not sensitive, such as 
system-administration programs not contained in the library, are 
Keot in a different directory. This facilitates dumping of these 
segments separately, and aids in the startup of new 
installations. At MIT, this second directory Is called 

>udd>SysAdmin> lib 

This "accounting library" directory may contains 

master. ec the main exec_com segment for the 

administration 

err * ec the exec_com segment invoked when errors 

occur 

blller.ec the exec_com segment Invoked for billing 

sys_admln_data the interlock to prevent multiple editing of 

the same segment 

value_seg a symbol-table segment which gives the value 

of certain constants used in the 
system-administration operations 

Installation-dependent system administration tools are also keot 
here. All system administrators should do a * , set_search_dlr"' so 
that they use the programs in this library. 
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'•accounts_overseer_«, then al I hi needs ?„ r,T V 'J"'" ' " 
function name followed b» , " eeds ,0 <"> Is type the 

ad» ini strator „ „„ri?E2 unSlr = n re oT^I^tandard 3 h*^*" 
overseer, "orocess ou.rwar » k ,ro ' ot Tn e standard Multics 
the string «ec SSr'Te!^; * " USt Drecede e ^ch command by 



ic master tunc arqs ... 



The examples given below 
restricted. Lines orefixed 



assume that the administrator is 



..«.. .-nx.d by-5„2 p :;i x ;; .5" bv " t i: -%:;»•" by ,he — •"- 
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add_anon 



Qfiaca±laQ« add anonymous user to project 

Qo.mma.nd. t add_anon 

UsaflS' This function adds an anonymous user to a 
"^delegated prolect «lth given home directory and initial 
orocedure and (optional) Dassword. 

£saaalst To add an anonymous user to the project "ProJS", 
tyoe 

u) add.anon Pro}5 I lmi ted.serv lce_syst em >udd>Pro15 

s) WarninoS anonymous user has no password 

_) r 1557 12.558 tfO*3^ 

s) Sional from System Control process! PDT. Instal 1 ed 
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bl I I 



Qperatjsnt run monthly bills 

Command ! bill 

U^a3£ J This function calls "biller.ec" to aid In billing 
ODerations. 

£5ca.moJ.e.! To preoare for billing, tyoe 

u) bill prepare 
To run the bills, type 

u) bill run 
To acceot a bill, tyoe 

u) bill accept 
To clean up after the bills have been written, tyoe 

u) bill delete 

See Chaoter k (cage 57) for a complete explanation of the billing 
process. 
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chaddr 



Operation* change person's mailing address 

Command, * chaddr 

U S 3 ge t This function calls the "change" function to change 
a person's address. This function is used to change ]ust the 
address for a single oerson. It does not Install the PNT? to do 
this, use "install PNT.ont" or do a regular change and answer 
ves, The address must be enclosed in quotes. Tf the address Is' 
not supplied, the old address will be displayed, and a change 
accepted. 

E-xamo le '• The address must be enclosed in quotes. To change 

the address for "Jones", type 

u) chaddr Jones "MTT 39-895" 
s) r 1557 12.558 ^n+3it 
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chal ias 



Operation I change oerson's alias 

QaimajidJ chalias (obsolete) 

Usage* This function has been removed from the system. The 
alias feature is not currently recommended, because we do not see 
a good way to implement it consistently. Design discussions are 
going on about the alias feature, and it will be either 
completely removed or fully supported. 
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change 



QporaJ. jan: modify user registration data 
C0.mm3.nd! change 

Hs_aaa« This function Is used to review and possibly modify 

us^r registration data in the urf and ont. Each item is typed 

out, and then the administrator may leave it unchanged by typing 
"no" or a carriage return* or replace It by new data. 

L&2mai£ : To change the default orolect for the user "Smith", 

tyoe 

u) change 

s) Enter userld 

ul Smith 

s) If you want to change any item, type the new data. 

s) Otherwise type "no" or hit carriage return. 

s) Name: Smith, John 

u) 

s) Address: MIT 3-001 

u) 

s) Programmer number: 123% 

u) 

si Protect: Quark 

u) Physics 

s) Change password? 

u) no 

s) More users to change? 

u) no 

s) Tnstal 1 now? 

u) yes 

s) Installing new pnt. 

s) Installation completed. 

s) r 1557 12.558 <+0*3*f 

s) Signal from System Control process: PNT installed 



Malts t 



H£X£S 5 The user's name should be given last name first, 
then a comma, then first name, a space, and middle Initial 
followed by a period. Names of the form "Smith, J. Alfred" are 
also allowed. If the user has a title, such as "Prof.", the 
title should follow the name and be separated from the name by a 
colon, =>s in "Smith, John J.:Prof.". You may tyoe "stoo" at any 
time to abort all the changes you have made to a particular user 
anl start over. In response to the query "Change password?" ^you 
m = « »c H «r "vos" and then give a new oassword, or "verify" to 
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change 



check that you have the correct password, or "no" to leave the 
password as is. The last name may be up to 32 characters long. 
The first name and middle initial field may be up to 2U 
characters. The address field may be up to 32 characters total? 
use slashes to seoarate lines of address. The Drogrammer number 
and title may each be up to 8 characters long. 



Multic*; System Administrator's Manual Page 25 

Q hapter 3 Administrator Commands 



chdf_pro| 



QpgratJQD? change osrson's default project 
Command* chdf_oroJ 

ijsagei This function calls the "change" function to change 
a Derson's default project. This function is used to change Just 
the default oroject for a single oerson. It does not install the 
PNTi to do this, either tyoe "install PNT.ont" or do a regular 
change and answer yes. If the default oroject is not currently 
in the oroject segment* a warning message will be printed. If 
the default project is not supplied, the old value will be 
displayed, and a change accepted. 

Tf the user has changed his own default project, with the 
"-chanqe_def aul t_proJect" argument to login, this change will not 
be effective. A soecial tool is available to unrestricted system 
administrators to force the change of a default oroject: this 
Drogram is called "pass_ut i I ". 

L&affiale* To change the person-id "Smith" so that his default 
oroject is "°roJ3", type 

u) chdf_oroJ Smith Pro]3 
s» r 1557 12.558 *f0+3<t 
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2aa ra. t i^Q J check log for info on user 

Command? check_log 

Uaaae* Sometimes a user will comolain that he can't log in. 
To finj out why, you can scan the log segment for the messaqes 
olaced there by the initializer which give the reason, 

£xamais* To see why "Jones" can't log in, type 

u) check_log Jones 

s) 702 09/22/71 1333.2 lg_ctl_i no I Jones. Mu I t les 2?kl 

022 chn tty302 reason bad_oass 

s) r 1557 12.558 kQ+3h 

This message says that the user could not log in becuase he gave 
the wrong password. His terminal TD was 022, and his channel was 
tty302. This message has severity tso it was not typed to the 
operator, Just logged), and is the 702nd entry in the current 
I og. 

The following is a list of reasons for not togging a user in: 

bad_pass bad password 

badpers person not in pnt, either not added or mistyped 

no_name no name given 

pwlocked password locked by administrator 

bad_proJ project does not exist In sat. may be mistyped 

no_pdt project's odt is not in >scl>odt. message with 

stars also tyoed online 
not_pdt user not in pdt for project, did you forget to do 

an "upmf?" 
anon_pw bad anonymous-user oassword 
already user already logged in, and no "multip" f \ aa 

(absentee does not count) 
no_acct no default account ID 
acct_.no project's account out of funds or past termination 

date 
hd_path bad oath name for home directory 
hd_nodir what should be home directory is ncn-dir branch 
hi_err some error In getting status of home directory 
hd_make error creating home directory branch, message in 

log 
hd_where home directory missing, does not seem to be betow 

project dir. we will not create. 
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sys_full system full according to load units 

saturate system full according to max. number of users 

cant_bum system fu1l» user cannot find anyone to bumD 

groupmax load control group at absolute maximum 

no_grouo load control group in sat not in mgt 

nf_nosec system not full* grouo full* no secondary 

sysgrpfl system full* group full* cannot bump 

c~og_err programming error in lg_ctl_ 
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chname 

SPacaliim* change person's mailing name 
C omma ncH chname 

Us^aa* This function calls the "change" function to change 
a oerson's mailing name. This function is used to change Just 
the name for a single oerson. It does not install the PNT? to do 
this, use "install PNT.pnt" or do a regular change and answer 
yes. The full name must be enclosed In quotes. If the name 
argument is not given, the old name will be displayed, and a 
change accepted. 

£xaffla±£* The name must be enclosed in quotes. To change the 
mailing name for the person-id "Jones", tyoe 

u) chname Jones "Jones, W. Alfred" 
s> r 1557 12.558 kQ*-3k 
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Qparat Lani change person's password 



£gm.maQd* 

Us age : 
change a 



choass 

This function calls the "change" function to 
>erson*s password. This function is used to change the 




change 



If the user has changed his own nassword, with the 
"-change.oassword" argument to login, this change will not be 
effective. A special tool is available to unrestricted system 
administrators to force the change of such a password: this 
program is called "pass_ut i I". 



EL^amaiej 

tyoe 

u) 
s) 
u) 
s) 
u) 
s) 



To change the password for the oerson-id "Jones". 



chpass Jones 

Change password? 

yes 

Passwords 

newpass 

r 1557 12.558 <*0 + 3i* 



(the printer Is turned off) 
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chprog 

Operation i change person's programmer number 
C_P_! land J chprog 

U sage t This function calls the "change" function to change 
a person's orogrammer number. This function is used to change 
Just the programmer number for a single person. It does not 
install the PNTT to do this, either type "install PNT.ont" or do 
a regular change and answer yes. The orogrammer number must be 
all numeric. It may be up to 8 characters long. Some 
installations use the "man number" assigned by the company in 
this field. If the programmer number is not supplied, the old 
value will be displayed and a change will be accepted. 

E xam o I e i To chage the programmer number for the oerson-id 

"Smith", type 

u) chprog Smith 7399 
s) r 1557 12.558 kQ + 3k 
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Opara t jqp i create user directory 

£o m m a. n d ! c u 

Usage. 8 This function is used to create a user's home 
directory. Home directories are created when the user first fogs 
in, and the "upmf" function calls this function, but in rare 
cases* it may be necessary to execute this function seoarately. 

E xampl e! To create the home directory for "Jones. Gamma", type 

u) cu Jones Gamma 

s) r 1557 12.558 i»0*3«» 
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Ope rat ion x orint daily billing output 

QoiHSilDJl ' day, dayok 

Li^l3a* Every night, a self-rescheduling absentee Job called 
the "crank" runs which does the daily charging of users and 
checks for users who should be cut off. 

The "day" command prints the output from the crank on the 
console* and asks whether or not to delete the output. The 
"dayok" command Just asks whether to delete the output. Unless 
there was an erro-", the absentee outout segment should be 
de I eted. 

£xamale,J The output from the crank should look like this* 

u) day 

s) 

s) Absentee user Accountant. SysAdmin logged in ... 

si r 0330 12.558 ^0*34 

s) 

s) ioacur - 731 cards, 20 charged, 708 previously collected, 

3 next period. 

s) Total charge: 3*f5.67 

s) Begin charging for 7/31/71 2355.0 to 8/9/71 23V5.1 

s) cut 3, warned 7, total charge $^5678.90 

s> r 1557 12.558 «*0 + 3** 

s) 

s) Absentee user Accountant. SysAdmin logged out ... 

s) Delete? 

u) yes 

See section 5.3 (page 63) for a complete explanation of the dally 
orocess ing. 
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Qper gtj on ; give project to oroject administrator 
C om mand t delegate 

Usage* This function is used to give a oroject 
administrator control over a oroject's omf. Once this is done. 
the project may add and delete its own users, and set 
resource-usage limits on users in the project. 

The command moves the oroject's pmf from "pmf .archl ve" to a 
soeclfied directory (keeoing a spare copy in 
"delegated_pmf .archive") » edits the sm f to show that the oroject 
administrator may install pdt's for this proj ect, and sets access 
on "oro J_admln_seg" and ">system_contro l_dlr>update" so that the 
administrator may Install his odt. 

A delegated oroject is under control of the Droject administrator 
only. The system administrator will receive an error message if 
he attemots to execute the "domf", "uomf", or "pmf" functions on 
a delegated project. Use the "undelegate" command if you wish to 
take a oroject back from a o^olect administrator, either in order 
to hay-j it controlled by the system administrators again, or so 
that it may be delegated to some new user. 

Example* To give "Jones .Gamma" control of project "Beta", 
Dlacinq the Dmf in ">udd>8eta", type 

u) delegate Beta >udd>Beta Jones. Gamma 

s) archive? Beta aooended to del egated_pmf .archive 

s) $ do a "new_smf" 

s) r 1557 12.558 (+0 + 3** 
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disk_report 



O perat ion* write disk usage report 

Hammand 1 disk_report, dm, dlsk_auto 

Usa^eJ This function is used to calculate a disk usage 
report. The administrator may type "dlsk_report" to cause a 
manual disk usage calculation. Normally, though, disk usage is 
done automatically every night by the absentee lob "dodrp", which 
executes the "disk_auto" function. (See chapter 5 for details on 
how the absentee use is managed.) 

The program "sweep" is used to get quota for all directories Into 
the data segment "dlsk_stat". The program "charge_di sk" then 
charges these usage figures to Drojects in their "projfile" 
entries. A printable segment, called "diskreport", is produced 
but not automatically printed. To print copies of this segment, 
type "r"nm diskreport". 

To run a disk report, type 

disk_report 

$ Creating disk usage report. 

$ Following figure is total quota/current use 

75500/6^32 

Charged 906 directories out of 910 to 108 projects 

r 1557 12.558 <f0 + 3«» 



Example? 




u) 




s) 




s) 




s) 




s) 




s) 
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Opera tion * remove user from Droject 

Command t domf 

Usage t This function deletes a user from a pro]ect master 
file for a project which is managed by the system administrators. 

Fxamo let To delete user "Black" from project "Gamma"* type 

u) dpmf Gamma Black 

s) r 1557 12.558 40 + 34 

s) Signal from System Control process* POT installed 
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Operation* delete project 
CojuaaQsts doroj 

Usage' This function Is used to delete a project. Tt edits 
the smf to remove the project entry, calls "epro" and "erf" to 
set the date off for the oroject, moves the omf for the project 
to "oldDmf .archive" in case It is ever needed again, and calls 
deletedlr to delete the project directory and all of its 
contents. 

E^am&ie.? To delete prolect "Delta", type 

u) dpro) Delta 

s) archive* Delta added to oldomf .archive 

s) type 

s) type 

s) dd: do you want to delete the directory >udd>Delta?? 

u) yes 

s) $ do a "new_smf" 

s) r 1557 12.558 «*0 + 3*f 

iiiflt.es * If you answer "yes" to the question about deleting 
the directory, the project directory and all segments and 
directories inferior to the oroject directory will be deleted. 
The project will be charged for disk usage until the project 
directory is deleted. If you answer "no", the project's 
directory and segments will not be deleted, and the project will 
continue to accumulate storage charges. Do not answer "no" 
unless there is some exceptional reason for doing so, since the 
project directory will have to be deleted later by an 
unrestricted system administrator. 
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instal ! 



Ope rat ion* Install system table 
Qommandt instal I 



u s£ ae. : 



^^^- This function Is used to instal I a system table. It 
can^be used when the table has already been converted f in case a 
orevious installation request failed due to a crash. 



Female.: To install the current pnt, tyoe 

u) install PNT.ont 

s) r 1557 12.558 **0 + 3«+ 

si Signal from System Control process* PNT Installed 
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ison 

QasTJLt JLatD. s see if person is registered 

C omman d? ison 

Us^sa: This function types "true" or "false" depending on 
whether a oerson is registered In the ont or not. It then lists 
all users in the user registration file who have a last name 
which matches the argument. 

Example* To check whether the user "Jones" is registered* 
type 



ison Jones 
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operation; print mailing labels 
Q omma ndt labels 

l js a,oe* This function prints a set of mailing labels 

offline. 

^^amolet To run the labels* type 

u) I abel s 

s> r 1557 12.558 kQ+~$h 
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misc 

Ope ration : orocess charges and credits 

Command t misc 

Usage ? This function Is used to Input miscellaneous charges 
and credits. For each transaction, the oroject TO, the amount 
(negative for a credit), and an explanation are required. Each 
transaction will result In a separate line on the monthly bill. 
The transactions are stored In "miscf I le", and the total Is also 
placed in "pro! file". All three input Items for a transaction 
may be put on the same line, or they may be supplied one at a 
time. The program will Indicate the type of Item to be inout 
next. Typing "x" Instead of a project ID exits from this 
f unct ion. 

E xamp le* To credit project "Alpha" for a crash, and charge 
oroject "8eta" for some manuals, type 

ul misc 

s) proj 

u) A loha 

s) amt 

u) -10.55 

s) explanation 

u) system crash 6/23 Jones 

s) pro] 

u) Beta ^.50 Manuals Smith 

s) proj 

u) x 

s) r 1557 12.558 kQ+lk 



Multlcs System Administrator's Manual Page •»! 



01/09/73 



rev 3 



Chapter 3 Administrator Commands 



new_pro| 



Qp,e.r a* ion* add new project 

Com mand * new_proJ 

Usage* this function is used to add a new project. 

Example* To add new project "Gamma", giving the user 
"FoochTGamma" project administrator status <I. e. write access on 
the orolect directory - the project is not delegated), and 
setting an initial quota of 100 records, type 

u) new_proJ Gamma Fooch. Gamma 100 

s) archive* Gamma aooended to pmf. archive 

First, the system asks for the project title. This field should 
be a short description of the purpose of the project. It may be 
up to 5? characters long. 

s) type type title 
u) Gamma Ray Research 

Next, the system asks for the name and address of the principal 
Investigator. This is the individual to whom the usage reoort 
will be addressed. Both name and address may be up to 32 
characters long. 

s) inv 

u) Prof. Q. X. Jones 

s) inv_addr 

u) MIT 39-895 

Next, the system asks for the name, address, and telephone of the 
oroject supervisor. This is the individual In direct contact 
with the project's day-to-day activities. He may be the same 
person as the prlncioal investigator, or he may not. Often, he 
is registered as a user or oroject administrator for the oroject. 
The name and address may each be up to 3? characters long. The 
telephone number may be up to 16 characters long. 



Fooch 



s) 


sup 




u) 


Mr. 


Mel vin 


s) 


sup, 


addr 


u) 


MIT 


39-896 


s) 


SUD. 


_Dhone 


u> 


MIT 


xl?3*f 
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At this point* the system has finished adding the project to 
"pro) file". You are now asked if you wish to review and correct 
the entry (by typing "o" and then perhaps "c") or i f you wish to 
continue with the registration procedure (by typing "file"). 

s) type 
u> file 

Now* the system adds an entry for the project to the requisition 
file* "reqfile" f first asking for the external account number and 
requisition or purchase order number. 

s) type account 

u) 11792 

s) req 

u) 123*56 

The system next asks for the cutoff limits for the prolect. The 
funds limit is a dollar amount (enter "0" to show an "open" 
amount) « The date cutoff limit is a date* expressed as either 
"mm/dd/yy" or "mmddyy". If the project exceeds either of these 
limits* all users on the project will be prevented from logging 
ln» but the project will continue to Incur disk and registration 
charges until you delete the project. 

si funds 

u) 

s) cutoff 

u) 7/30/72 

Next, the system asks for the name and address to which charqes 
incurred by the project should be reported. The name and address 
may each be up to 32 characters long. 

s) name 

u) Fiscal Office* Attn? L. Soottswood 

s) addr 

u) MIT 1-101 

At this point the project has been added to the requisition file. 
You are now asked whether you wish to review and edit the entry 
(by typing "p" and perhaps "c") or if you wish to finish 
registering the project (by typing "file"). 

s) type 
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u) fife 

s) * do a "new_smf" 

s) r 1557 12.558 ^0+34 
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new_smf 



Operation: convert smf to sat and install 

C ommand i new_smf 

Usaget This function is used after any change Is made to 
the smf. It converts the smf to a binary sat* reruns 
"dail y_summary" to insert cutoff codes* and requests the 
initializer to install the new sat. Those functions which make 
changes to the smf will remind the administrator to do a 
"new_smf". Since this function is t line-consuming* it should be 
done at the end of a bunch of changes. 

u) new_smf 

s) r 1557 12.558 i*0 + 3k 

s) Signal from System Control orocess* SAT installed 
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omf 



SG^caliao ! 



Fdit and convert nmf, install odt 



Qom ma n i s 

l) s a ge t 

omf . It 

readlna 



pmf 



function is used to do arbitrary editing of a 

administrator into the aedx editor after 

in the segment, and allows him to 



This 
throws the 




E.Xa2i&i£ ' 



To edit the segment "Opera tor. pm f "» type 



ul omf Operator 

s) Edit. 

u) (editing commands) 

u) w 

u) q 

s) r 1557 12.558 i»0+3*f 

s) Signal from System Control process: °0T installed 
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proJ_mtd 

Qoer ation * month-to-date report 

C omman d* pro|_mtd 

Usa ge* This command types a month-to-date report for any 
oroject's usage. The report lists all users on the oroject and 
their dollar totals* as well as disk and miscellaneous charges. 

E ^a , mple * To get a report of the usage for oroject "ALPHA'S 
type 

u) proJ_mtd ALPHA 

s) Month to date for pro} ALPHA 

s) Name logins charge 

s) White 11 $ 133.^1 

s) Brown $ 0.00 

s) 2 users 11 $ 133. hi 

s) registration $ 20.00 

s) mlsc $ 0.00 

s» disk $ 176.0* 

s) Total $ 329. **9 

s) r 1557 12,558 i»0 + 3«* 
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Op jrat j on ' generate omf from odt 
Command? recov 

Usaa£' This function is used if a project's PMF is 
destroyed. The function generates a new PMF from the system's 

binary POT. 

5xamo lei Suppose the project "Pro J 2" loses its pmf. To get a 
new one, type 

uJ recov Pro]2 

s) r 1557 12. 558 «»0 + 3<* 
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Operat i on t Register new oerson 
Command* register 

Us. age.* This function is used to reqlster a new person-id. 
It enters him in the "urf" and in the "ont". If a person is 
already a user of Multics* or if he was once registered and was 
not removed, this function should not be used since the user will 
still be in the urf and ont. 

Enter "stop" at any time to abort the processing of the current 
user, for Instance if you have misspelled his last name, or if he 
is already registered. 

Examo let To register a user, the dialogue goes like this! 

u) register 

s) Enter full name (Last,First I.) 

u) Smith, Robert M.tProf. 

s) Enter mailing address 

u) MIT 39-575 

si Enter programmer number or "none" 

u) 6789 

s) Enter default project 

ul Language 

s) Password! 

u) wugga (the printer Is turned off) 

The system will attempt to generate a unique person ID for the 
oerson being registered, by trying first his last name alone, and 
then his last name prefixed by his initials. If either of these 
guesses succeeds, the system makes a tentative assignment and 
asks if the person ID is acceptable. If neither of the guesses 
succeeds, and If you relect the system's guess, the system will 
ask you to specify a person ID, and will then check to make sure 
that the ID is unique. 

s) Userid "Smith" Is already used by "Smith, Frank X." 

s) Trying "RMSmith" for userid. 

s) Userid assigned is "RMSmith" 

s) Is this ok? 

u) no 

s) Please suggest a userid for "Smith, Robert M." 

u) RSmith 

s) Userid assigned is "RSmith" 
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register 



s) Is this ok' 
u) yes 



At this ooint, the user has been added to the user registration 
file and the PNT, You may now add more users* or if you are 
finished registering users* you may install the PNT immediately 
or later". 



s) More users to add? 

u) no 

s) Instal I now? 

u) yes 

s) Installing new Dnt. 

s) Installation completed. 

s) r 1557 12.558 tf0*3t* 

s) Signal from System Control 



processt PNT installed 
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rename_proJ 



Q perat j ont rename project 

Command; rename_proJ 

liSiae.! This command is used to rename a project. 

Example* To rename project "AAA" to "888", type 

u) rename_Dro] AAA 888 

s) Now do a *new_smf* and then a *pmf 888* 

s) also change default project for users on 8B8 

s) r 1557 12.558 *t0 + 3i* 

u) new_smf 

s) r 1557 12.558 1*0 + 34 

s) Signal from System Control Process: SAT installed 

u) pmf 888 

s) Edit. 

u) q 

s> r 1557 12.558 i*0+3k 

s) Signal from System Control Process* PDT installed 
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rqm 



Qp^rgt jjnt request statistics to be printed 

Command? rqm 

Usage, { This function requests the dprinting of a reoort for 
all administrators* The single argument Is the name of a segment 
to be dorlnted. 

^xamjile.: To send a codv of the disk usage reoort to all 
administrators* type 

u) rqm diskreoort 

s) r 1557 12.558 kQ + V* 
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setcrank, setdisk 



Ope rat ion* Schedule absentee Jobs 

C_ommajQd.s_t 3,3k setcrank, setdisk 

Usaasl These commands do the initial scheduling of the 
absentee Jobs described in chapter 5 (oage 62) which perform 
daily accounting. Unless the absentee Jobs crashed or the 
absentee Job oueues were lost, there is no need to execute these 
commands. to check whether a Job is scheduled, type 

lar -aueue 1 -long 

If the Jobs "dodrp" or "crank" are not scheduled, execute 
"setcrank" or "setdisk" as appropriate. 
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undelegate 



Opera t i on t Undelegate a project 

C_o.mma.nd J undelegate 

Usa ge s Execute this command if you have delegate a prolect 
to some user, and wish to regain control of It or delegate it to 
some other user. 

PxamD_±e_» To change the project "BLAH" from control by 
Smith. RLAH to control by Jones, BLAH, type 

u) undelegate ^LAH 

s) archive! BLAH appended to pmf. archive 

s) $$$ do a new_smf 

s) r 1557 12.558 kQ*Zk 

u) delegate 8LAH >udd>BLAH>Jones Jones. ^LAH 

s) archive: BLAH appended to delegated__Dmf . archive 

s) $$* do a "new_smf* 

s> r 1557 12.558 i*Q*1k 

u> new_smf 

s) r 1557 12.55S ^0 + 31* 

s) Signal from System Control Process: SAT installed 
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upmf 



Command J 



add user to project 



uomf 




Example.: 



To add user "Jones" to project "Gamma"* type 



u) upmf Gamma Jones 

s) r 1557 12.558 <*0+3<t 

s) Signal from System Control processt fQT installed 
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Other commands 



DJ2e_ra„t JL.2D. ! other commands 

Commands? eoro f erf, mail, helo, logout, status, 
llstacl, listcacl, lar, car, mq, ga 

USia3£ s Consult the MPM and the M»M S^S for details on the 
usage of these commands. A short explanation of each follows. 

car cancel absentee request. Use this function 

if an absentee Job is scheduled too many 
times by mistake. 

enr edit "orojfile". Use this function to change 

a project's supervisor name, title, etc. 

erf edit "reqfile". Use this function to change 

a project's account number, requisition 
number, funds, cutoff date, etc. 



ga 



qetquota. Use this function to print 
directory's disk quota and usage. 



help print information on command usage. 

lar list absentee requests. Use this function 

(usually with the **-q 1" argument) to list 
your absentee requests. 

listacl list access control list. Use this function 

to check accessibility of a segment. 

listcacl list common access control list. Use this 

function to check accessibility of the 
contents of a directory. 

loqout log out from Multics. 

nail read or send mail. To read mall sent to you, 

tyoe 

mai I 
To send mail to some other user, tyoe 

mail * Person Project 
and then type your message, ending with a 
line consisting only of ".". 
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Other commands 



mo 



movequota. Use this function to shift quota 
to a directory from its superior. 



status 



print information about a segment. Use this 
function to see when a seqment was created. 
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The following is a short explanation of the monthly billing 
process and the information used in monthly billing. 

The most Important thing to remember is that the monthly billing 
process consists mostly of a print pass over the saved PDT's and 
a print pass over "reqfile". Other information is also taken 
from "orojfile"* "miscf i I e", and "bi 11 ing_footnote". No pricing 
out of usage Is done during the billing process: this has all 
been done during the dally Drocessing. 

k»l Outout from billing 

The reoorts outout from the monthly billing process are: 

i. long_bill - this report is a complete breakdown and 
Justification of charges for each oroject. For each 
project, the bill will have from one to four sections? 

a) charge summary, by user 

b) Interactive usage* by user 

c) absentee usage* by user 

d) I/O daemon usage* by user 

In addition* the charge summary shows the oroject's 
disk and miscellaneous charges* lists the current 
Drices* and may have a footnote intended as a message 
to all project supervisors. 

2. short_bill - this report consists of Just the charge summaries 

from the long bill. The prices -and footnotes are 
suppressed. An elaborate grand total page is printed. 
This report is intended for the use of system 
administrators and facility directors* who find the 
long bl I I too bulky. 

3, bill - this report is a listing* by account number, of the 

charges made to each account. One line is orinted for 
each prpject, showing the charges this month and the 
charges to date, face amount* and requisition balance. 

k* msum - this report is the monthly summary. It has one line 
per requisition or purchase order, and gives the same 
information as In "bill". 

5. cards - at the MIT installation, this deck is punched for 
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transmittal to the MIT General Accounting Office. The 
program "punch_MIT_deck" oroduces this segment. The 
peculiar format of the cards and the many ad has 
decisions in the code are the result of the accounting 
office's requests. 

It is expected that other installations will remove all 
mention of this program, if they don't need any 
externa! record of charges* or that they will Insert 
some local orogram which may or may not produce cards 
in place of "ounch_MIT_deck". 

6. mlscs. print - this is a listing of all miscellaneous charges 
and credits for the month. 

H* dbac-t - this reoort is the result of an absentee ) ob 
fabricated by the billing process and run later. It 
I ists every daemon session during the month in 
chronological order, and shows, for each session, who 
used the daemon, how much he used, and what shift and 
aueue he used. 

9. syst sm_month. report - this segment gives a summary of Multlcs 

usage for the billing oeriod. 

10. diskreport - this reoort shows each project's disk usage for 

the month. It also has a map of every directory in the 
hierarchy which has a disk quota, giving its current 
usage, its charge for the month, and its quota. 

11. conso le.reDort - this report shows the usage of each 

terminal, sorted by terminal ID. For each user who 
used a given terminal, the total connedt time during 
the month and the number of logins is shown. 



h.Z Inouts to bill ing 

The inout segments to the billing process and what of their 
contents is used are listed below. 

1. POT's - the cooled odt segments In 

>udd>SysAdnin>admin>saf e_pdts contain the complete 
usage data for each user for the billing oeriod, 

2. pro] file - this segment is used mostly to get the disk usaoe 

figures, which are stored there when a disk reoort is 
run. The project title and the name and address of the 
project supervisor are also used to create headings on 
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the long and short bills. 

3. reqfile - this segment has the charges which are actually 
billed. Daily processing has updated "reqf 1 le" from 
the figures in the PDT"s* so the two should agree. (An 
error comment is printed if they do not* and the 
•■reqfile" values are used.) The name and address of 
the person in charge of the account as well as 
requisition numbers* amounts* and cutoff dates are also 
extracted from this segment. 

k. miscfile - this segment is the Journal for miscellaneous 
charqes and credits associated with a project. On both 
the short and long bills* all entries for a particular 
project are located In this segment and re-printed. 
(If the total of charges and credits In "orojfile" does 
not match the total from adding the individual entries 
in "miscfile*** an error comment will be printed and the 
total from "miscfile" actually billed.) 

5. bi I ling_f ootnote - this segment is optional. If present* all 

the text in it will be Drinted at the bottom of each 
project's usage summary. This segment can be used to 
announce forthcoming price changes* or make other 
announcements to the administrators for each oroject. 
It is printed on the long bill only. 

6. disk_stat - this segment Is used In the preparation of the 

disk report. 

7. today. use_totals - this segment is used In the preparation of 

s ys t em_month. report. 

8. The accounting segments saved In the subdirectory "h" are also 

used In the preparation of "dback". 



Multics System Administrator's Manual Page 60 

01/09/71 rev 3 

Chanter k Bll 1 ing 



if .1 SteDS in bill inq 

The o^ocedure for oreparlng a bill consists of three oartst 
orenaratlon, actual runninq-off of the outout t and cleanup 
operations once the bill is Judged correct. 

The o<~eparation phase consists of checking for any un-processed 
dormant accounting segments* and checking to see that a disk 
renort has been run recently. 

bi I I prepare 

does most of this. The administrator should also make sure that 
the segment "bi I I ing_f ootnote" is up-to-date, and that all 
miscellaneous charges are input. The administrator may run a set 
of mailing labels at this time. 

The actual running of the bill is initiated by typing 

bi I I run MM DO YY 8XXXXX 

where MM/OD/YY is the date of the last day of the month. The 
anument RXXXXX is used by "punch_MIT_deck" - other Installations 
will probably reolace this argument with others more appropriate 
to their needs. 

The "run" processing oreoares all of the above reports and bills. 
It dDrints one cooy of the bills In the highest aueue before 
st3rtinq on the usage summary reoort. 

As soon as the administrator has examined his copy of the bill 
anj found no gross errors, he may type 

bi I I accept MONTH 

which causes the following? 

1. dorinting of many copies of the billing output and reports. 
The addresses for these reports are obtained from 
"val ue_seq". This dorinting is done by the "rqbill" 
f unc t ion. 

2. Submission of absentee Jobs to create the output reports 
"conso le. report" and "dback". 

3. Copying of the segments used to create the bill into the 
directory HF. The names of these segments are orefixed by 
the MONTH snecified as an argument -- for examole, "reqfile" 
is copied into "HF>MONTM.reqf i I e". 
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*». Resetting of the various data bases for the next month. The 
proqram "reset_usage" is run to subtract the user usagp 
figures in the copied odfs in >udd>SysAdmin>admln>saf e_pdts 
from the usage figures in the odfs in 
>system_control_dir>odt, so that the month-to-date usage 
totals will start over for a new month. The program 
"uo_ctr" is also run, to add the "charges this month" field 
in jVeqfile" into the "charges this requisition", and reset 
the charges this month". Any entries in "reqfile" or 
"orojfile" which are marked as having been deleted durinq 
the month are then deleted. 

5. Resetting of the disk meters in the directory branches. The 
program "reset_di sk_meters" Is used to subtract the value of 
the time-oage-DPoduct integrator used for charging (stored 
in "disk_stat") from the value in the branch. 

Once the bills have been mailed out, and everybody who should 
have a copy has got one, the administrator should delete the 
bills from the disk by tyoing 

bill delete 

The amount of storage required by the bills will vary, of course, 
defending on the number of users registered on the system, and 
the number of sessions used during the month. It may come to 
several thousand disk records. Be sure to have enough quota 
before starting the billing run. 
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The daily billing and statistics are produced through the agency 
of two absentee Jobs which run every night, and which re-schedule 
themselves to run again the next night. The first lob is the 
disk storage accounting. The second Is the actual 
accounting-segment update run. Both Jobs oroduce reports which 
are dorinted for the system administrator.- 



5.1 Use of Absentee 

The disk accounting Job is controlled by the command segment 

dodrp.absin 

This Job executes only one command* namely "disk_auto" and then 
logs out. 

The accounting-segment update run Is controlled by the command 
segment 

crank. absin 

which also executes only one command* namely "crank", and then 
logs out. 

Each Job reschedules itself In queue 1 for the next night, by 
executing the "enter_abs_request" command to re-submit the Job. 
The time at which the Job is scheduled is kert in value_seg» 
under the variable names "crank_time M and "disk_time". The disk 
report should run before the crank, In order to charge the most 
uo-to-date disk figure to the users. 

The disk report Job is restartable, so that If the system crashes 
during its run, it will be rerun. 

The crank Job cannot be restartable. If the system crashes and 
segments are reloaded, users might be double-charged or not 
charged at all fo^ some usage. (See chapter 10, "Crash 
Recovery", for more information.) Therefore, the crank Job is 
marked not restartable, and furthermore the variable 
"abort_crank" in value_seg is used to stop the crank from running 
again, if it crashes. When the crank is about to enter Its 
critical region, it sets "abort_crank" to "true". When it oasses 
the critical region, it sets "abor t_crank" to "false". fSome 
parts of the Job, those dealing with summaries and so forth, need 
not be orotected.) When the crank first starts uo, it checks 
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"abopt.crank", and if it is "true" it immediately logs out. 

5.?. Disk reporting ^un 

Sep the writeuo of "disk_auto" for details on what is done by the 
disk reoorting run. The important result of a disk reporting ]ob, 
from the point of view of charging, is the storing of current 
disk usage figures in the segment "pro] Hie". These figures will 
be picked uo by the accounting uodate Job later and used to 
charge the project for disk usage. 

5,1 Daily accounting run (crank) 

The "crank" Job executes a command of the same name in master. ec. 
This command performs the follwoing steps: 

1. reschedule the crank for tomorrow 

2 % process al I 10 daemon records in 

>system_control_dlr>10 accounting which have not yet been 

orocessed and which have been completed. Call 
charge_daemon_usage to add this usage the the aoorooriage 
POT entries in >syst em_contro l_dlr>odt . 

3. make a backup copy of the answering service version of 

the Dnt. 

k. call odt_cooy to copy all system pdt's into safe_odts 

5. run "comoute.bi I I" to charge user usage, from the odfs, 
to the aooroprlate entries in reqfile. 

6. run "daily.summary" to write a report giving account 
status and to modify the sat to cut off projects which are 
out of funds. 

7. install the new sat. 

5. run "daily_l og_orocess" to prepare log extracts for 
system programmers and administrators. 

9. run "cooy_as meters", "orint.meters", "system_tota 1", 
"usage_total", and "system__dai I y_report" to prepare a system 
statistical report. 

10. dorint cooies of the ouput reDorts. 

11. check for the existence in >system_cortro l_dir of any 



Multics System Administrator's Manual Page 6^ 

01/09/73 rev 3 

Chapter 5 Daily Processing 

data segments which need orocessing. 10 accounting files 

and logs are processed automatically. Answering service 
dumps are automatically orinted. 

The Job sends a message to the system administrator reporting 
successful completion via the "send_message" command when it is 
a I I done. 



5,h Daily operation 

Every day* first thing in the morning, the system administrator 
should read the output from the crank. If it has not been 
dorinted because of a system failure, or because the output is 
lost, the administrator should log in and type "day" (see the 
write-uo of "day" in chapter 3, page 32) to see the output. If 
everything ran correctly, the administrator merely replies "yes" 
to the "Delete?" question and logs out. If the output has been 
dorinted successfully, the administrator can avoid having it 
tyoed again on the console by executing "dayok" instead. 
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New_proJ is the tool for adding a new project. You will want to 
Know th-a following! 

Suoervisor 

User list (must have at least one user) 

account* requisition numbers 

funds 

termination date. 

bi I ! ing address 

delegated'' if so* what user id and what directory 

initial quota 

The project TO can be the same as a person ID i f you want, 
Projects which have been deleted and then return are a problem: 
try to avoid this. 

The sequence for adding a new oroject 1st 

1. new_oroj (see page kl) 

2. new_smf (see nage kh) 

3. register any new Dersons (see page *»8) 

k, use "uomf" to add each person to the nroject (see page 
5k) 

5. delegate the project if requested (see page 33) 

You may batch several projects in step 1» of course* and do many 
registrations in step 3. 
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Chapter 7? Adding and Oeletinq Users 

To add a user to an existing project, you use the tool "uomf". 
(see page 5^.) If the user is not already registered, uomf will 
tyoe a warning message. If you get this message, register the 
user with "register". (see page **8.) 

To delete a user from a oroject, use the tool "domf". (see cage 
3«5,> The user will remain registered as a person, and his 
address and oassword will remain in the system. If the user is 
leavinq the Installation, and Is not exoected to return, you 
should not remove him from the urf and pnt immediately, since his 
name may be on some access control lists. For instance, if the 
person named "Jones" quits the company, it would be unwise to 
remove the name "Jones" from the user registration file riqht 
away: suooose someone else named Jones arrived the next day. 
When he was added to the system, he would have access to some 
segments which he should not have. The unrestricted system 
administrator's tool "remove_user" can be used to completely 
remove a user from the PNT and user registration file. 
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This section deals with making and keeping the system secure. A 
system may be run loosely or tightly* but some security is 
necessary even if the installation does not care if resources are 
mis-appropriated. Security measures not only frustrate immature 
individuals* they orovide insurance that accidents will not 
destroy the system* and provide information about what happened 
when something went wrong. 



8.1 passwords 

Each registered Multlcs user has a personal password. This 
oassword is his personal orooerty, and is associated with the 
oerson, not the user identity (combination of person and 
project). Project administrators need not know the passwords 
associated with the persons working on their project, although 
since the project administrator usually assists in getting a new 
user registered* he may know it. 

Passwords are stored in scrambled form Internally within the 
system. Once a user's password Is entered (via the "register" or 
"change" commands) it is not stored in readable form anywhere in 
the system-administration data bases. When the user attempts to 
log in, the oassword he types is subjected to the same scrambling 
transformation, and the scrambled values are compared. This 
procedure makes It fairly difficult for a user to obtain another 
user's password, even If he Is given access to the ont by 
mistake . 

* 

The password mechanism is the strongest orotectlon feature in 
Multlcs? if users cannot be uniquely identified, then different 
access control rights cannot be granted. Users should be 
encouraged to keep their oasswords private, and to change them 
often. Sensitive oasswords, in Darticular, should be changed 
regul ar I y . 

Users may now change their own oasswords dynamically, by use of 
the "-change_oassword" argument to login. They should be 
encouraged to do so often. Once a user has changed his oassword 
by use of this login option, subsequent Installations of the PNT 
will not reset the password. The "chpass" administrator command 
will continue to work though, since it uses the orogram 
pass_util" to modify >system_control_dir>ont directly. 



•• 



The answering service keeps various counters in the PNT regarding 
the use of a password. In particular, the system counts 
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incorrect passwords, and can type a message to a user at loqln 
informing him how many times his password has been given 
incorrectly since its last correct use. This feature may alert a 
user tnat someone has tried to guess his password. 



8.? Access control 

Access control is the system's second major line of defense. 
Consult MPM sections 1.2. 6 and II. 3 for an explanation of the 
mechanism. Properly set, the access control mechanism can make 
the system very secure, at the cost of some inconvenience. 

Access control works only if user identities are held secure. 
This is the reason that person identifiers are assigned only by 
the system administrator: otherwise, a clever project 
administrator could register an identity which corresponded to 
some name already on an access control list somewhere In the 
system, and so be able to log in and use this access control list 
entry for a purpose not foreseen by the creator of the ACL entry. 

The qeneral orirclole to apply is that no user should have write 
access to any system data base unless there Is a good reason. 
Tho^e few, trustworthy individuals who may modify system data 
bases should be impressed with the fact that they should not use 
the privileae casually. It is a good Idea to run an absentee Job 
occasionally which soot-checks the access control lists on system 
segments to make sure that something has not been left 
unorotected inadvertently. 

Thp question of read access Is less clear. It is possible to 
orevent users from reading anything except their own directories 
and their contents, or one can leave most of the system readable. 
Two specific cases are interesting: the choice between "e *.*.*" 
and "re *.*.*" on the CACL of >user_dlr_dir makes the difference 
between users being able to tell who is registered on another 
oroject or not. The access control list on 
>system_control_dlr>answer_table makes the difference between one 
logged-ln user being able to determine another user's process Id 
without oermission and not. 

Currently, the system is slightly deficient In that the SysOaemon 
ant SvsAdmin users have far too much Doner. Someday, we will 
change the system to lock the daemons Into subsystems which 
cannot execute any but carefully-checked commands, and we will 
remove most qlobal access rights, either getting along without 
thorn or accomplishing them in lower rings with lots of checking. 
As the system stands now, disclosure of a Sysoaemon or SysAdmin 
oassword oDens the system uo completely. In the future. It would 
be nice to have the system secured to the point where no malor 
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breach of the system's segment security could be accomplished 
without entering the machine room. 



8.3 Telephone line security 

TaoDing a phone is very easy. If sensitive data-i such as 
passwords* are transmitted by phone* the system is no more secure 
than the telephone connection box. An installation which thinks 
It is worth the trouble to protect against this sort of potential 
oroblem could consider dedicating GIOC channels to 
SDecial -purpose uses such as daemons and administrative 
operations. The privileged users could then have start_up.ec 
segments which logged out if they were not Invoked from the 
proper channel. Consoles on these dedicated channels could be 
hard-wired If close enough to the GIOC (there are other good 
reasons to do this) or could be connected over dedicated 
telephone lines* perhaps even with a pair of the "scrambler" data 
sets which are available commercially. 



8,t» Terminal 10 codes 

If the terminals used on the system identify themselves with an 
ID code* it is often easy to track down what terminal was 
involved in a security breach. Me are considering a method of 
restricting use of the system by using terminal ID codes* as an 
optional feature. Since these 10 codes can always be faked* one 
cannot rely on this feature alone. But If terminal ID Is free on 
a terminal you are considering* definitely get It, The program 
"console_report" is used to produce a listing of all terminals by 
ID code, with the list of users who used the terminal during the 
month. 



8.5 Use of the log segment 

The program "dai ly_log_Drocess" can be used to monitor system 
operation by setting up its I og_se lect_f i !e to watch for 
conditions of interest. The version provided with the system 
will create a full log of all events* a log of all "interesting" 
events for system programming* and special logs for absentee 
problems and network oroblems. This segment can be edited as 
necessary to monitor specific individuals* or specific terminals. 



8.5 Cross-checking in the billing process 

It is very hard for any user to get away with using Hultlcs 
resources without leaving some traces. Even if someone gets 
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lodged in on a system administrator identity* and attemots to 
fudae the accounting records to conceal the fact that he logged 
in, most usaae is recorded in more than one nlace. Unless the 
thief figures out how to oatch all of the usage data* some 
accounting program will oroduce a "discrepancy" comment. 



8 . 7 Machine-room security 

It is not always necessary to run the facility like Fort Knox in 
order to decrease the chances for security breach substantially. 
Tf the general Drinciole of having only ooerators or accompanied 
visitors is established* if outout Is distributed outside the 
comouter room and users are not allowed to hang over the 
ooerations consoles* and if users are not allowed to mess with 
the machine when it is down* most possibilities for oroblems will 
be eliminated. 



8 . 8 Tace security 

If users can walk off with dump taoes* or mount them for 
themselves* the storage system is not at all secure. Work is 
currently going on concerning the design of high-quality 
detachable media secuity measures. 



8.3 What to to after a breach. 

Once the administrator finds out that someone has used a password 
he shouldn't have been able to* what does he do? Partly* the 
answer deoends on what kind of oroblem has occurred. Clearly* 
all sensitive passwords should be changed simultaneously. Date 
and time modified of all segments should be checked* to see what 
has been changed. Prints of the logs and accounting segments 
should be made and cross-checked. Consider a complete reload. 



8.10 Password trap 

The answering service maintains a "trao" flag In the PNT* in each 
user entry. By using the Drogram "pass_util"* a system 
administrator can cause this flag to be set on. Whenever the 
oerson logs in, a message will be typed on the initializer and 
filed in the log* remarking that the password has been used. No 
indication that this has haooened Is given to the user. This 
feature can be used when you suspect that a certain password has 
been comoromised and you wish to catch the fellow red-handed. 
Since the terminal ID and channel number are tyoed in the 
message* it is often easy to locate the user. There is another 
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flag which may be set* which "locks" the password* without 
changing it. (As a matter of fact, the user may even change his 
password while it is locked.) The user will be unable to log in 
if his password has been locked. 

The Incorrect password counter mentioned in section 8.1, and the 
identification of the terminal from which the last bad password 
was issued* are also stored in the PNT. 

The system administrator may also choose to set an entry in the 
system message table to cause a user to receive a "blast" message 
whenever he is logged In and someone attempts to log in with the 
same name, project, and password. This feature may alert the 
user to the fact that his password has been compromised: It is 
also useful in some cases of network use, since a user may log In 
from a remote host which then goes down without Informing Multlcs 
— if the user then attempts to tog in via some other network 
route, the blast message sent to the first instance of the user 
will cause him to be logged out. 
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Disk storage accounting is done by a self-rescheduling absentee 
Job* as described in chapter 5. A byproduct of this process is a 
list of all orojects which are low on disk. The administrator 
responsible for disk should attempt to give enough disk to all 
projects to allow them to keep operating. If prices are set 
correctly* this will always be orofitable until the time comes to 
expand the building housing the computer. 

If sufficient quota is avalable on >udd to satisfy a project's 
need* all the administrator needs to do is to type 

movequota >udd>Pro1 INCR 

to increase the storage available to Pro) by INCR records. 

To generate more quota on the system* do a setquota o_n. the roof 
g nl v either from the initializer console or via "sac"* and then 
move the quota down to >udd* as follows? 

sac "sq > 3000? mq >udd 1000" 

suooosing that the root quota Is normally 2000. 

It is oermissible to have more quota allocated than is physically 
available. The acutal amount of overal location depends on how 
fast the community uses up quota and how closely the disk quota 
is watched? this can be determined only by experience. Caution in 
this process is recommended* because the system crashes if it 
runs out of space. 

For more discussion on this point* see section 13.1 (page 86). 
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Usually* at this point, it is possible to use the editors to 
create an exec_com file which consists of the remainder of the 
steps in the crank, and then to execute it on-line. 

Tn some cases, data which was lost may be regenerated* for 
instance, if "projfile" is lost, you should retrieve a copy, use 
"eoro" to add any projects which were added since the copy you 
have, and to edit any other entries which changed, and then 
re-run the disk report to recalculate the oroject usage, Tt is 
difficult to provide a fool-proof prescription for recovery, 
since what must be done depends on what segments were lost or 
damaged. If your investigations seem to show that all is well, 
type 

valuefset abort_crank false 

to allow the crank to run again. 

Do an "lar" to make sure the crank and disk reoort Jobs are 
scheduled. If not, do a "setcrank" and/or "setdisk". 
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There are two situations of interest concerning accounting setuo. 
The first concerns the startup of accounting at an installation 
which has never had a Muftics before — this is called an 
"accounting cold start". The second concerns the modifications 
necessary for an installation which receives a new distribution 
of Multics* with significant changes to the accounting oackage 
which may require the reformatting of segments* or other 
modifications, in order to continue to operate. 



11.1 Accounting cold start 

Accounting cold starts are supported by the exec_.com segment 

acct_start_up.ec 

which is distributed as part of the system libraries. In 
general* all that the local installation need do Is* on Its first 
successful bootload* enter admin mode on the initializer and type 

ec acct_start_up cold 

and then follow Instructions. 

11.2 Accounting warm start 

Although some work has been done on designing an accounting 
warmstart, the supplied procedures may have defects if you are 
upgrading more than one level of accounting system in a Jump, or 
If you have made modifications to the supplied accounting 
procedures for support of local installation features. It is 
imoerative that you study and understand the contents of 
acct_start_uo.ee before executing them. Read both the cold and 
warm start sections. The warm start procedure is designed to 
uograde the accounting system from the previously-distributed 
level to the new leveM if it looks like it will work, you may 
tyoe 

ec acct_start_UD warm 

from the initializer console. As of this date* no general 
accounting-distribution orocedure has been developed. This 
deficiency in the system will be corrected* module by module, as 
time permits. In the meantime* the best thing to do Is to read 
the exec_.com and skiD those steps which look like they would 



Multics System Administrator's Manual 
01/09/73 

Ohioter 11 



Page 7«5 
rev 3 

Setting up Accounting 



destroy data. 

Pay careful note to the header of the SAT which is created by the 
coldstart. If your SAT header does not look like this* you may 
need to change the default attributes. 

It is a good idea to at the very least reconvert the SAT* via 
"new_smf M , and reinstall it. It cannot hurt to recompile all 
D 0T*s and reinstall them too. Delegated projects may be a 
nroblem here. If the format or contents of the PDT changes in 
such a way that this step is absolutely necessary, a conversion 
or o gram will be suoolied. 

Examine the segments created by the coldstart. If you don't have 
any of them, execute that section of the coldstart which creates 

t h? m . 

Th^> segment bound_adm t n_o I d_ contains Drograms which used to be 
nart of the system administration subsystem, but which have been 
obsoleted. The orograms in this bound segment are sometimes used 
for conversion from one level of the accounting system to the 
next . 



11,3 Local Installation oarameters 

Most installation oarameters used in the operation of the 
administrative system are kept in the segment 

"Instal la tion_narms". The standard accounting cold-start 
exec_com segment sets these parameters to the MIT values, in most 
cases. A discussion of each Darameter follows. 



11.3.1 Shifts 

System usage may be divided into uo to eight shifts, numbered 
from to 7. These shifts may begin at any half-hour during a 
week! the current shift is the same for everyone, and the shift 
Is the same at the same hour during every week. There is 
currently no provision for over-riding the regular shift 
mechanism to account for holidays. Shifts are set by filling in 
a table which contains 336 entries, one for each half-hour in the 
week, with a diqit from to 7. At MIT, we use only shifts i, ?, 
3 9nd 4, and the hours a^es 

shift 1 0800-1900 weekdays 

shift ? 18 0-2*4 weekdays 

shift 3 0000-0900 every day 

shift k 0800-2400 weekends 
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11.3.2 Shift prices 

Prices may be set for CPU time f connect time* process time, core 
usage* and device usage on a per-shift basis. The current 
mechanism does not actually generate any charges for any but CPU 
and connect time. Later versions will dlstinaulsh between 
connect time and orocess hours* to allow multiple orocesses oer 
user and multiple terminals per user? we will also implement core 
charging and device channel usage charging. Any installation 
mav* of course* set the prices for some resources to zero and use 
other administrative means to control resource usage. 

The calculation of the proper price for the use of a resource has 
been the subject of endless argument. Every local installation 
will have its own special way of computing these rates. The 
method we have evolved at MIT is the following! first, we list 
all costs involved in running the service. This includes 
programmer and operator salaries* cards and paper, hardware 
rental, and modems. (Desired orofit or planned loss could be 
included — we attempt to break even.) These costs are then 
attributed to cost pools, one for each resource which is 
chargeable. Resources which cannot be attributed to the cost of 
providing a particular service, such as operator salaries or the 
motor generator, are lumped in the category "overhead," and the 
cost of this pool is soread proportionally over the others. Each 
pool's cost is then divided by estimated pay ino-customer usage, 
to obtain a "break-even price." These figures are then fudged to 
make reasonable prices. If an estimate is uncertain, we round up 
strongly. For shift differentials, we use the following tablet 

of break-even 



shift 


1 


11 57. 


shift 


2 


907. 


shift 


3 


507? 


shift 


k 


80% 



We also usually round the shift prices up to the nearest multiole 
of $.50 oer minute, Just to make the prices easy to remember. 

The program "price" is available to interested system 
administrators from T. H. Van Vleck? it mechanizes the pricing 
philosophy discussed above. 



11.3.3 Installation 10 and titles 

Instal tation_parms contains the 32-character Installation 10 
field which is typed out when a user dials up. This should 
contain both the company and department abbreviation, and the 
city an1 state. For example, 
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MIT, Cambridge, Mass. 

The installation titles are longer character strinqs, returned by 
the program system_inf o_-5 t i 1 1 es, which are used at the too of 
each page of the monthly bills and in many other reports. There 
ara two strings, the comoany name and the department ID. Both 
st-ings are entered twice, once single-spaced and once 
double-spaced. For example, 

Massachusetts Institute of Technology 
Information Processing Center 

and 

Massachuset ts .... 

Locally-written administrative tools should, of course, use these 
titles so that they can be exported to other installations. 



11. 3. *f Miscellaneous parameters 



The maximum time allowed for a login time, the cycle time between 

and the maximum inactive time 
a normal user ere all given in 
The number of login tries a user 
hangs up on him is also specified 



initializer accounting updates, 
before automatic logout for 
seconds in insta I I at ion_parms. 
may have before the system 
there . 



The usual values for these oarameters are! 



inact i ve_tlme 
warn lng_t ime 
I ogi n_t ime 
acct_update 
login_tr ies 



15-90 mins. 

3-5 mins. 

3-5 mins. (more 

10-60 mins. 

1-if 



i f noisy I ines) 



Those values may be modified according to the needs of the 
Installation, The ranges given are reasonable limits, though. 
F or examnle, the accounting update cycle should not be too small, 
or Initializer time will go way up, and it should not be too 
la'-qe unless the system hardly ever crashes, or revenue will fall 
off. Consult the SPS writeuo of the ed_installati on_oarms 
command for more information. 



11.3.5 Messages 



Insta I I at ion_parms also contains the messages typed out on the 
user's console if his account is out of funds, nearly out of 
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funds, oast its termination date, or nearly oast its termination 
date. We out the teleohone number of the User Accounts Office in 
these messages, to make sure the user Knows who to call, 

11. 3.6 Daemon and absentee rates ' 

These rates are kept in insta II ati on_oar ms, in an item named 
"queue". Absentee CPU and real-time prices are stored by queue, 
as are 10 daemon rates oer 1000 lines. Queues one through four 
may have rates set, 

11.3.7 Absentee "timax" parameter 

The scheduling priority for a Mul tics process is calculated by 
the scheduler by a complex algorithm which takes several factors 
into account. Consult the MPM SPS for the details of this 
calculation. For system-administration purposes, what is 
imoortant is that each process, when it is created, is assigned a 
parameter called "timax", which limits the depth to which the 
orocess may sink in the scheduling queues. Interactive processes 
are assigned the default timax, which is currently 8000000 
microseconds. The timax value for absentee processes, however, 
is obtained from insta I I at ion_parms, and may be different for 
different queues. A larger number wilt allow a lower queue* at 
MIT, we set all queues to have a timax of 16000n00. This means 
that absentee Jobs sink rapidly to the bottom of the queues, 
where they are given relatively long CPU time limits, and that 
interactive users will always get better response than absentees. 
Sy setting the values associated with the item "timax", an 
installation may experiment with other values for the absentee 
timax. 



11.3,8 Configuration Table 

A table is kept in "insta I I at ion_parms" which describes each of 
the system configurations which an installation will use, by the 
number of CPU's, number of 6*tK memories, and shift. For each 
such entry, the table contains the value of the maximum number of 
load units allowed on the system, the maximum number of absentee 
users allowed, the highest-numbered ( lowest -or lor ity) absentee 
queue from which Jobs will be run, and two resoonse control 
parameters. Unless automatic adjustment of maxunlts has been 
disabled (see the writeuo of "admin" In the SPS, and the ooerator 
command writeuD of "maxu") , this table will be referenced to set 
maxunits whenever the system is brought up, whenever the shift 
changes, and whenver the system configuration changes. The 
configuration is looked up in the table, and maxunits and the 
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absentee maxima are changed. 

If resnonse control is enabled* the system will attempt to adjust 
maxunits on every login and logout, so that the average queue 
length falls between the "low" and "high" values. Maxunits will 
be increased whenever the average queue length is below "low"? it 
will be decreased whenever the queue length is above "high"? and 
it will be set to the current number of users whenever the queue 
lenath is between "low" and "high". 

The order of the elements in the configuration table is 
significant. The elements should be in order- by number of CPU's, 
within that by number of memories, and within that by shift! 
smaller numbers first. The lookuo will continue as long as anv 
table element is less than the value being looked uo, so that an 
element sepcifying 9 CPU's, 100 memories, and shift 8 will always 
stoo th.3 lookuo. This feature can be used if, for instance, your 
installation does not wish to have different parameters depending 
on shifts instead of having eight table entries for each 
combination of CPU and memory for shifts 0-7, you may suooly only 
one entry, which has a shift number of 8. 



11. <+ Runtime constants in value_seg 

The symbol-table segment value_seg is used, with the active 
function value, to insert certain installation-variable 
parameters into the ooerations conducted by the master exec_com. 
The most important of these values are 



cr ank_t ime 
disk_t ime 

admin_addr 

accts_addr 

directorX_addr 

abor t_crank 

sysa_addr 



the time of day that the crank runs 

the time of day that the disk accounting 
runs (this should be before the crank) 

address, in dprint header, of system 
administrator 

address, in dprint header, of system 
accountant (user accounts office) 

addresses, in dorint header, of 
directors (currently, up to 7 may be 
named) 



"true" if crank is to abort, 
"false" (see section 5) 



else 



address, in dprint header, of system 
assurance 
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sysprg_addr address* in dprint header, of system 

programmer 

admin_onllne person and project id of user to send 

"crank ran" message to 

log_number current number of log segment being 

processed 

The critical values are set to reasonable values by the 
accounting coldstart. they may be changed with the valuefset 
command. The command "valuejdumo" may be given to type out all 
values in value_seg. If the various addresses in the dprint 
header are set to "skip", the "ram" and "rqbill" commands will 
skip printing of the corresponding copy of the file. 



11,5 Modifications to the exec_.com segments 

Some installations may wish to build additional administrative 
tools and insert calls to them into the cooies of master, ec and 
biller.ec which are used by the local system administrator. In 
oarticular, most Installations will wish to remove the call to 
punch_MIT_deck from the monthly billing and Insert something more 
appropriate to their own needs. This is easy to do, since the 
system-library copies of the exec-corns are copied into 
>udd>SysAdmin>l lb. It is a good idea, though, to keep careful 
notes on what modifications were made to the segments and why, so 
that the changes can be made again after a new version of the 
accounting package is distributed with a new system version. 



11.6 Load control group table 

Consult chapter 1** (page 89) for information on the system 
parameters which control the load control facility. Note that 
setting up load control requires determining what groups are 
required and which projects belong in each group, and then 
deciding how much of the system maxunlts each group should be 
able to occupy. These decisions require some picture of the 
normal load pattern of the system, as well as knowledge of the 
priorities attached by management to Individual prolects. 
Installations which are Just starting up should probably being 
with Just two groups, "System" for the system users such as 
daemon orocesses and other uses which are "part of the system", 
and "Other" for everybody else. If significant system 
orogramming work will be done on the system, a group for the 
system programmers — those on the project "Multlcs" — may also 
be necessary. 
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11.7 System Message Table 

Answering services numbered 6.12 and higher make use of a SDecial 
system facility to allow local installation replacement of all 
answering-service produced messages to users* without 
modification to the code in bound_user_cont rol_. The unbound 
segment as_error_tab I e_ may be replaced by an Installation to 
tailor the messages typed out by Multics to local installation 
requirements. 

The procedure for modifying a message is quite simple? a system 
orogrammer edits as_er ror_tab 1 e_. et to modify the text of the 
message, compiles the segment via error_tab I e_comoi I er and aim, 
anl installs the new system message table. 

Several of the entries in the message table are actually format 

strings for loa_. These items may be edited, but the 

data-transmission items in the format must, of course, remain in 
the same order. 

If the installation does not wish to have some of the messages 
tyoed by the system, it may choose to make the text of the 
messages null in the table. For example, to suppress the "Last 
login was..." message, the following line should replace the 
statement for " I ast_l og in_msg" in as_error_tab I e_.ett 



last_l ogin_msg: 



I I lwas,: 
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Several special user identities are built into the organization 
of the Multics system, or are referred to by the documentation by 
name. This section describes the various soecial identities and 
their oecul iaritles. 

12.1 Full system administrators 

Full system administrators are users on the project "SysAdmin" 
who have the normal initial procedure* "process_overseer_". 
Since they have potential write access on every segment in the 
system, and since they may access the highly-privileged gate 
"hohcs_" and the privileged gate "phcs_", they can cause great 
damage to the system by InapproDriate execution of a command. 

12.2 Restricted system administrators 

Restricted system administrators are users on the project 
"SysAdmin" who have the special initial procedure, 
"accounts_overseer_". This program allows them only a small set 
of innocuous commands, and the ability to execute any function 
contained in the segment "master. ec". A great deal of 
self-checking is built into the command sequences contained in 
"master", so that a non-programmer can be trained to operate as a 
restricted system administrator. 



12.3 IO.SysDaemon 

The 10 daemon has control of the printers, readers, and punches 
on the system. Its initial procedure is "daemon_exec_". The 
daemon is special in that it has write access on the daemon 
queues contained in 

>daemon_dir_dir>lo_daemon_d ir 

so that it may remove processed requests from the queues. The TO 

daemon does its accounting in the segment "TO accounting" in 

>system_control_dir. Excepte when it is in the procedure 
"act_ctl_" it has no access to segments in >system_contro l_dir, 
to prevent users from requesting prints of the password segment. 
The project "SysDaemon" and the user "IO.SysDaemon" have the 
"multio" attribute flag, so that the 10 daemon can be logged in 
more than once, in order to run more than one printer. 



Multics System Administrator's Manual Page A3 



01/09/73 



rev 3 



Chanter 12 Special User Identities 



12. k Backup. SysDaemon 

Th^ Backup daemon ooerates in ring 1, instead of ring *♦* so that 
it may 1umo all segments which are part of the hierarchy. It 
comes uo in ring 1 bcause the statement 

ring: 1 » 1 * 

has been added to Its omf entry In "SysDaemon. pmf ", and because 
the smf gives permission to SysDaemon to have users log in In 
lower rings because It has the statement 

ring? 1, 7? 

in the pmf entry for the prolect "SysDaemon". Its Initial 
procedure is "rrocess_overseer_". This user has soecial access 
rights to al I directories on the system* through the medium of 

the SPACL. 



12.5 Dumper .SysDaemon 

Th* Dumoer daemon is used to perform comolete dumps of the 
hierarchy. It is otherwise Just like Backup. SysDaemon. 



12.6 Retr iever. SysDaemon 

The Retriever SysDaemon is used to retrieve user segments from 
complete or incremental dump tapes. It operates in ring 1, and 
its initial procedure is "process_overseer_". It is on the 

SPACL. 



12.7 Transl ator. SysDaemon (obsolete) 

The Translator daemon has been eliminated* now that absentee is a 
regular facility of Multics. It represented a potential security 
hole in the system, since it attempted to write segments in the 
user area» and could have ended up writing segments which were 
accessable to *. SysDaemon but not to the user. 



12.8 Ring_l_Repair. SysDaemon 

This user comes up in "process_overseer_", but in ring i. This 
is the only user who can execute any command from the console in 
ring 1. This identity is used to fix problems with access control 
in ring 1, The password for this user is kept in a sealed 
snwpinnn in the operations area. 
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12.9 Reoair.SysOaemon 

This user Identity is provided for evergency fixes by system 
orogrammers who need SysDaemon access orlvl leges. The password 
for this user is keot in a sealed envelope in the operations 
area. 



12.10 Repair. SysAdmin 

This user identity is provided for emergency fixes by system 
programmers who need SysAdmin access privileges. The password 
for this user is kept in a sealed envelope in the operations 

area. 



12.11 Network Oaemon 

This user Is logged in to provide the functions associated with 
the Network Control Process. Its "star t_up.ec" segment brings uo 
the network* and then monitors the operation of the network. The 
primary functions of this user are to assist in the initial 
connection between foreign hosts and the system, and to perform 
segment-transfer operations. 



12.12 anonymous users 

Anonymous users are al I given the access control ID "anonymous" 
instead of a person ID. Their usage is aggregated on the monthly 
bill and the statistics under the heading "Student Users". The 
"who" command lists them as "anonymous"* and the "as_who" command 
lists them with a star in front of the name. There is no reason 
why an anonymous user cannot be a project administrator. 



12.13 Fictitious persons 

Sometimes* a project wants to register a full user identity which 
corresponds to no real person. This practice wit! work* but 
should be discouraged unless a good reason can be advanced* since 
it tends to circumvent the access control mechanism. To add a 
fictitious person* type in the name of the real person in charge 
of the identity to the register command* preceded by an asterisk, 
"register" will then know that it should not attempt to generate 
a userid from the name* and will ask for the userid. The names 
beginning with asterisk will be skipped when mailing labels are 
generated from the urf. 
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12. i<* Project administrators 

Project administrators are registered Mult ics users who are in 
charge of some nroject. They need not be registered on the 
nroject they administer. A single user may be project 
administrator for many orojects. Each orolect administrator 
anoears in the smf entry for the project he administrates. He 
has a copy of the project's pmf, and may install a pdt which he 
creates from this omf with cv_omf* by use of the install command. 
The Droject administrator must be able to read "pro J_admin_seg" 
in order to use the install command* and he must have "ea" access 
on the directory >syst em_contro l_dlr>uodate in order to out the 
cooy to be installed where the system can discover it. 

Project administrators should be trustworthy people. They should 
be toll to aoooint an alternate if they go on vacation* since it 
is difficult for a system administrator to run a project which 
has been delegated to someone else. 



12. 15 Project 



•Multics' 
•Multlcs' 



Users on the "Multlcs" project are able to access the privileged 
gate "ohcs_" to investigate the contents of the supervisor. 
Since they can* therefore* steal passwords from the lnnut 
buffers* only responsible system programmers should be registered 
on this project. 



12.16 Terminal repair 

The project "Terminals" should be set up with one anonymous user 
whose Initial procedure is "terminal s_overseer_" so that 
remote-terminal service personnel can login and check out a 
terminal. Bumping should be on* and a grace of only 5 minutes 
set . 



12.17 System operators 



All system operators should be registered on the project 
"Operator". This provides them access to the system for the 
out-pose of sending mall* document runoff* and harmless play. It 
is far better to provide them with a small amount of disk space 
and soma CPU time of their own* than to discover them using the 
daemons for experimenting with the system. 
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There are several ©Derations necessary to keep the system runninq 
smoothly which are not yet made Into commands for a restricted 
administrator. 



13,1 Disk auota moving 

The daily disk report lists alt those projects which sre low on 
disk quota, Some of these projects deserve more disk, and others 
do not — they will use uo all that is available. An automatic 
program could be written to give more disk to those In need, and 
to take quota from those projects which had extra? but the 
algorithms Involved would be complicated and ajj hoc, and manual 
adjustment and Intervention would still be required. 

A restricted system administrator can do some of this quota 
moving, since he has the movequota command available, but It 
takes some experience, and is hard to exolaln. 

The general strategy Is to keep some extra quota on 
>user_dir_dlr, available for giving to new projects or to old 
projects which are running out of disk. Issuing the command 

movequota >udd>Alpha 50 

will give the project named "Alpha" 50 more records of quota. A 
negative amount will move quota up from a prolect to >udd. 

The difficulty arises when the free quota on >udd runs low. 
There are two possibilities* if the Installation has a total 
quota which Is already as much in excess of physical capacity as 
should be allowed (for instance, if the disk is over 90% 
physically full), no more quota should be generated. The 
administrator must either take quota from some other oroject, or 
from some system directory, or deny the request. Knowledge of 
the various projects* activities and moral suasion may have to be 
emoloyed. A "hold" should be out on new Droject registrations, 
too, since new_oroJ will gripe if it cannot christen a new 
oroject with enough disk. 

If, on the other hand, the administrator wishes to raise the 
total quota on the system, say by 1000 records, he should issue 

the command 

sac "setquota > 3000? mq >udd 1000" 
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(assuming the auota on the root Is normally 2000). The 
"send_adm in_command" (sac) command sends a message to the 
initializer process which will be performed as soon as the 
initializer gets a chance. The command line executes a 
"setquota" to increase the root quota* and then executes a 
"movequota" to move the quota down to >udd, where it can be 
distributed as usual. 

The sequence described above is the only time that the setquota 
command should be used. This is because the disk-metering code 
in the storage system and the disk-accounting program require 
that disk quota form a "connected tree" with no directory which 
has a quota inferior to one that does not. 

See Chapter 9 (page 72) for more information on disk quota 

management. 



13.2 Cleanup of segments 

Giving the restricted system administrator the "delete" command 
would allow him to destroy any data segment on the system. 
Therefore* it is up to the full system administrator to clean up 
segments* especially in >udd>SysAdmin>admln and Its 
subdirectories* which are no longer needed. 



13.3 Load control group management 

New projects will automatically be assigned to the default load 
control group. "Other"* by the new_pro] function. Placing a 
oroject in a grouo requires modification of the segment 
"smf.new"* followed by a new_smf. All that is reauired is to add 
the I ine 

groups Blah! 

after the "projectid" statement which defines a project. 
Generating a new group is done by running the program "ed_mgt"» 
which is documented in the MPM SPS. 



13. ^ Soecial Project requirements 

Creating privileged projects* or under-privileged prolects* or 
editing the omf of a oroject to give It soecial treatment* must 
be done by the full system administrator. Consult the M D M SPS 
writeuos of cv_smf and cv omf for more information. 
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13.5 Access to project directories 

Access control is the oarticular province of the system 
administrator. One thing he has to do that cannot be entrusted 
to the restricted system administrator is to provide the various 
oroject administrators with access to project directories. Tn 
some cases, the system administrator may be called upon to give 
access to one user's segments to a user from some other oroject. 
It is important to have someone responsible performing this 
function, so that ill-advised or malicious requests can be 
refused. 



13.6 Crash Recovery 

Unrestricted system administrators may be called in to rescue the 
crank or the system administration subsystem if the system 
crashes while some accounting operation is In progress. The 
soecific steps to take depend on the nature of the crash and on 
the operations being performed when the system went down. 

The worst crashes are those which are followed by a reload in 
which some accounting files are lost. Sometimes, this may keep 
the system from starting up? or worse, the system may start up, 
but be using old or inconsistent data. Operations should have 
standing orders to contact a system administrator if segments in 
the administrative directories are destroyed. 

More often, the difficulty is less catastrophic* for Instance, 
the system may crash during a **new_proj", and If the new_proJ is 
reoeated it will turn out that a project is in smf.new twice. 
Restricted system administrators should be told which functions 
cannot be restarted? or told never to do anything more, if the 
system crashed while they were doing something, until the state 
of the accounting files can be checked. 
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Load control groups are groupings of projects which share a 
guaranteed access to the system. Each load control grouo has a 
quota of "primary" load units which represents a guaranteed 
number of users from the group who will always be able to log in. 
Users In excess of the primary quota will be assigned "secondary" 
status and will be allowed to log in if the system is not full. 
Secondary users will be preempted If a primary user wants to log 
in and the system is full. Secondary users may be preempted to 
primary, and their grace recalculated, If a Drimary user from the 
group logs out. 

If a group*s primary quota is full and the system is full, a user 
from the grouo will not be permitted to log In unless he is 
oermltted to preempt some primary user in his grouo. This 
preemption is under control of the project administrator, who has 
two parameters he may adjust. In order to preempt another user, 
a new user must have the "preempting" attribute in the POT, and 
his project must have the attribute in the SAT. In order to be 
preempted, a primary user must have his "grace" expire. The 
"grace" is set by the oroject administrator in the POT, subject 
to a maximum grace given in the SAT. 

The attribute flags "no_primary" and "no_secondary" may also be 
set in the PDT or the SAT. If a project has the "no.prlmary" 
attribute, none of its users may be primary. Similarly, if a 
project has the "no_secondary" attribute, none of its users may 
be secondary. These flags may also be set by the oroject 
administrator for individual users. 

The "guaranteed_togin" attribute is used only for system 
projects. If a user has this attribute in the PDT, and if his 
oroject has the attribute in the SAT, then the user will be 
logged in if at all possible If he specified the "-force" 
argument to login. He may overload the system In the process of 
logging in, or may even have to bump a primary user If the system 
has attained Its maximum number of users. 

The accounting system will be set uo with two grouos by the 
accounting cold start. One group is called "System", and is for 
the use of the daemons and system administration — those users 
vital to the operation of the system. The rest of the users on 
the system will be placed In the "Other" group. To define 
additional load control groups, use the "ed_mgt" command to edit 
the master grouo table. For examole, to add a group called 
"SysProg" and to give it to the project called "Multics", perform 
the following ooerations from an unrestricted system 
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adTiinistratort 



ed_mgt >system_contro1 _dir>master_group_t ab I e 

a SysProg 5 

w 

q 



edit smf.new 
1 orojectid: 
i iroupt 

w 
a 



Mul tics' 
SysProg- 



ec master new_smf 

The control parameters for 
exoressed as 



group are its primary quota* 



constant * max units * numerator / denominator 



so that the number of units allocated to a grouo ^as a quarantee 
and a oortlon which varies with the number of units allowed on 

optionally* an absolute maximum number of units 
primary or secondary. This maximum is also 



the system? and» 
for the group* 
expressed as 



constantl + max_units * numeratorl / denominator! 

The absolute maximum can be used If you orefer to see the system 
at less than maxunits rather than having many secondary users in 
some grouot this strategy may provide better response for those 
users who do get logged in. A orlmary quota of "-1" for a grouo 
indicates that the grouo should taKe "all the rest" of the 
primary quota on the system, after those groups which have fixed 
quotas have been deducted from maxunits. No more than one grouo 
should have a quota of "-1"» or havoc will result. The total of 
all orimary quotas must not add up to more than maxunits. 
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The following is a list of the wrlteups which contain additional 
information about the system administration facility, its 
orograms and data bases. 



Multics System Programmer's Manual 

The published documents on system and user control In 
section BQ are almost completely worthless. They describe 
programs which were never used* and in most cases never 
written. In some cases* one can discover design principles 
mentioned in these old documents which have been followed in 
the construction of today's facilities. 

A completely new section 8Q is being prepared, which will 

provide an overview of the system and user control 

facilities actually part of the system. This project Is not 
high-priority. 



Multics Programmer's Manual 

See section 1.2, "Logging In", and the command wrlteuDs for 
"login" and "logout", 



Multics System Administrator's Manual 
This document. 

Multics Project Administrator's Manual 

Describes the duties and powers of the project 
administrator. A copy of this document should be given to 
each project administrator. 

On-line help segments 

See the segments "charges. info", "load_ct I . inf o", 
"I ogin.info", and "user_contro I . Info". 
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Multics Programmer's Manual - System Programmer's Supplement 

The currently installed programs which support 
administration and user control are documented in this 
manual. The writeups to read will be listed by category. 

System Control 

system_startuD_ - system ring 1 overseer 
system_control_ - system usei — ring overseer 
sys_log_ - initializer error messages 

User Control and Answering Service 

absentee_user_manager_ - absentee Job control 

absentee_uti I ity_ - absentee Job scheduler % utility 

act_ctl_ - accounting 

admin - operator commands 

as_ - answering service startup 

as_meter_ - system metering 

asu_ - tyoewriter attachment 

aswa_ - tyoewriter and network i/o 

cpi_ - process creation 

datebin_ - date conversion utility 

dhodh_ - access checking utility 

dlal_ctl_ - slave console control 

dlalup_ - line control* login line oarse, logout 

dog_ - process destruction 

hash_ - hash table utility 

hash_index - hashing function 

lg_ctl_ - login decision, user identification 

load_ctl_ - load control decision 

not_ascll_ - string-checking utility 

rehash_ - hash table utility 

scramble. - password scrambling 

test_dialuo - testing tool 

up_pdt_ - Ddt validation and updating 

uo_pnt_ - pnt validation and updating 

uo_sat_ - sat validation and updating 

UD_sysctl_ - system table update control 

Administration and billing 

access_name - add or delete access control names in UCT 

accounts_overseer_ - Initial procedure for administrator 

admln_utll - lock and unlock sys_admin_data 

as_who - privileged who» for operator and admin. 

ch=»r ge_daemon_usage - TO daemon charges from deck to PDT 

charge_disk - charge disk to projects 

charoe oroJects = to_accts - monthly billing 



Multics System Administrator's Manual Page 93 

01/09/7^ rev 3 

Bibl iograohy 
MPM SPS Sections 



charge_user_ - POT modification utility 

charge_user_registration - monthly billing 

charge_users_to_accts - monthly billing 

cl ear_oroj f i le - monthly billing, cleanup 

cl ear_reqf i le - monthly billing, cleanup 

compute_bi I I - daily billing 

console_edit - utility to update termseg 

consol e_report - generate console reoort by id code 

copy_as_meters - copy stat_seg for statistics report 

cooy_ont - make pnt copy for testing with blank passwords 

craate_l ines_f He - installation startup tool 

cv_persmf - compile persmf into pnt (obsolete) 

cv_pmf - compile omf into pdt 

cv_smf - compile smf into sat 

daemon_acct_print - print daemon accounting deck 

dai I v_log_orocess - generate reoorts from log 

dai ly_summary - daily billing report 

disk_stat_print - print disk charge figures 

disk_usage_stat - sweep disk and print statistics 

disk low - report on projects low on disk 

dump_anstbl - dump answer table for debugging 

ed_instal lat ion_parms - edit installation parameters 

ed_mgt - edit master group table 

edurf - edit user registration segment 

eoro - edit project segment 

erf - edit requisition segment 

fill_urf - pass through urf, get missing data 

format_attributes_ - output format utility 

get_Dassword_ - oassword reading utility 

get_uid_wlth_lastname - search urf for last name 

get_user_ - monthly billing subroutine 

hash_table - hash table maintenance 

ldsort_ - fast sorting utility 

install - install system tables 

is_he_user - active function 

is_l egal_oroJ - active function 

labll - print billing labels 

mai I ing_labels - orint user labels 

merg - monthly billing 

merge_ur f_pnt - obsolete 

misc - input miscellaneous charges 

new_user - register or change user 

pdt_cooy - cony all POT's to safe directory 

ppro - print orojflle 

prlnt_disk - print project disk charges 

orint_log - print log segment 

orint_meters - create statistics reoort 

orint_pdt - print pdt 
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orint_Dnt - Drint ont 

orint_sat - print sat 

T~ocess_<iaemon_cards - daily billing 

orocess.sess ion_cards - daily billing 

proJ_mtd - month-to-date project report 

oro] _usaqe_reoort - month-to-date project rerort 

ounch_MTT_deck - monthly billing 

qf o - print reqf i I e 

remove_user - unregister user 

rename_Dnts_ - utility for new_user 

rese t_disk_meters - monthly reset of disk meters 

rese t_r>rocessed_f I ag - natch accounting deck flags 

reset_usaqe - reset usage data in PDT 

rese t_use_tota Is - reset usage totals for reports 

send_admin_command - send command to initializer 

set_admin_data_ - locking subroutine for sys_admin_data 

sort_h ist_f i I e - sort bi I I inq data base 

so~t_oro| f i I e - sort oroject database 

sort_reqfile - sort requisition data base 

sweep - disk quota and charge accounting 

sweeo_dlsk_ - disk hierarchy sweeo 

sys_f u I l_reoort - report on refused logins 

syst em_da 1 1 y_report - write daily report 

syst em_month I y_repor t - write monthly report 

system_total - comoute system availability for reports 

term Ina I s_overseer_ - terminal repair In 1 1 proc 

uo_ctr - update charges this requisitlon f monthly 

urfp - print urf 

urfsort - sort urf 

usage_total - comoute system usage for reports 

value - active function and command 

wr ite_acct_bi I I - monthly billing 

wr ite_bi I I ing_summary - monthly billing 

wr it e_user_usage_reoort - monthly billing 

Data Bases 

answer_table - answering service user database 
communications - system control password 
dlsk_stat - disk charge figures 
instal lation_parms - installation parameters 

10 accounting - daemon accounting deck 

I o q - answering service log 

miscfile - miscellaneous charges | ournal 

mqt - master grouo table 

odt - project definition table 

pit - process initialization table 

pn t - person name table 
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oroJ_admln_seg - system table installation 

pro] file - project segment 

reqflle - requisition segment 

sat - system administrator's table 

stat_seg - answering service statistics 

sys_admin_data - system administration lock 

ur f - user registration segment 

use_totals - report data base 

whotab - oubllc list of users logged in 

master. ec - system administrator commands 

biller.ec - billing operations 

err.ec - administration errors 

util.ec - administration utility 

acct_start_up.ec - installation accounting startuo 



Multics System Administrator's Manual 

01/09/73 



Page 96 

rev 3 



Aooendix 1* Sample forms 



Generating a few workflow forms for the use of the user 
accounting office can simplify the ooeration noticeably. The 
forms will enable you to make sure that the necessary information 
is caotured. Each installation will have its own peculiar 
requirements for these forms, so no general scheme is Drovided. 
Samples of the forms in use at MIT are attached. 

You will orobably want the following: 

oerson registration form 

oroject registration form 

Droject deletion form 

taoe registration form 

retrieval request form 

system prob lem/comol aint form 

credit reauest form 

card processing request form 

configuration change log 

Roger says 

user accounts all-purpose letter 

user taoe log 

miscellaneous charge input 

crash form 

backup taoe log 



Massachusetts Institute of Teehnolopy 
Information Processing Center 

Person Registration for Multics System 

This f >rm is only needed for Deoole who have never been 
reiiste^ed on Multics before. 



Nane 



Last First Middle 

Mailing address 

Telenhone 

Programmer number (if any) 

Each oe^son registered on the Multics system is assigned a !-?<* 
charac+er "Person ID", which is unique at this installation. The 
person 10 Is usually the last name (beginning with a capital 
letter) If oossible- if someone else with the same name Is 
already registered* the person II will be the last name with 
Initials prefixed (e.g. Smith, JSmlth, JRSmlth). 

Default Droject TD 



Registered persons must also be authorized to use a oartlcular 
oroject by the project administrator for the project. 

Please attach a slip of paper with a personal password. Your 
oasswori may be 1-8 characters (letters and digits only). 

You may change your default project ID or your password on-line 
any time you wish* consult the Multics Programmer's Manual. 

Please return this form to* 

Information Processing Center 
User Accounts Office, room 39-513 
M.I.T., 77 Massachusetts Avenue 
Cambridge* Massachusetts 02139 

If you have any problems with your registration, please contact 
the Use- Accounts Office (253-^118). 



Name Assigned Date 

by _ 
form revised 9/72 



Massachusetts Institute of Technology 
Information Processing Center 

Project Registration for Multics System 

Project Title 



Princioal Investigator 
Address 

Project Supervisor 

Address 

Phone 



Each oroject is assigned a "Project ID" (1-9 characters beginning 
with a capital letter) for identification and access control 
ourooses. Please suggest a oroject 10 for your project! 



Initial disk quota records (default 25) 

MIT acct Requisition or P.O. 



If you wish to administer your oroject on-line, please supply the 
following informations 



Directory for PMF 



Administrator (Person. ProJ ect) 



Project ID Assigned Date 

by _ 
form revised 9/72 



Massachusetts Institute of Technology 
Information Processing Center 

Multics Project Administration Request 

TO* User Accounts Office, MIT 39-513 

FpriM: 



DATEl 



SUUECTt Project 10 



[ 1 Please delete the oroject and all Its disk storage. Scratch 
all tapes and release all lockers associated with the 
project . 

[ 1 Please add the following persons to the project. Person 
registration forms are attached for any persons not 
previously registered. 



[ 1 Please delete the following persons from the project. Do not 
delate their directories. 



t 1 Please give project administrator status to the following 
user (i.e. delegate the oroject). 

Directory for PMF 



Administrator (Person, Pro J ect ) 



Date done by 

form revised 9/72 



Massachusetts Institute of Technology 
Information Processing Center 

Hultlcs Project Administration Request Confirmation 

(Project suDervisorJ 



FROM: user Accounts Office, HIT 39-513: 253-M18 
A T E t 

SUBJECTS Project ID 



t 1 Your project has been set up on Multics as reouested. 

[ 1 Your oroject has been deleted as requested. 

t 1 The following users have been added to your project. 



[ 1 The fol lowing users have been deleted from your project. You 
should delete their directories once you have copied any 
segments which you wish to preserve. 



t 1 Your oroject has been delegated to a project administrator. 
He may now add and delete users and control resource limits. 

Oirectory for PMF ____„„ 



Administrator (Person. Pro J ect ) 



Date done by __ 

form revised 9/72 
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